Function at 0x407c4d
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set environment variable
Set registry value
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0xdc]
sub esp, 0x15c
mov eax, dword [0x6d1d44]
xor eax, ebp
mov dword [ebp + 0xd8], eax
and dword [ebp - 0x7c], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xe4]
mov ebx, ecx
push str.__DUMMY__
push 0x6d5d24
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x6c], edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov eax, dword [ebp - 0x70]
xor esi, esi
test eax, eax
jle 0x407d3b
mov eax, dword [ebp + 0xe8]
mov dword [ebp - 0x80], eax
mov eax, dword [edi + esi*4]
mov ecx, str._recovery
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407cce
test dl, dl
je 0x407cca
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407cce
add eax, 2
add ecx, 2
test dl, dl
jne 0x407cae
xor eax, eax
jmp 0x407cd5
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
jne 0x407ce3
or dword [ebx + 0x254], 0x40
and dword [ebp - 0x80], eax
mov eax, dword [edi + esi*4]
mov ecx, str._nocertstore
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407d0b
test dl, dl
je 0x407d07
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407d0b
add eax, 2
add ecx, 2
test dl, dl
jne 0x407ceb
xor eax, eax
jmp 0x407d12
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
jne 0x407d2d
and dword [ebp - 0x80], eax
push str._Not_using_Certificate_Store__n
call fcn.00401109
xor eax, eax
inc eax
pop ecx
mov dword [ebx + 0xc28], eax
mov eax, dword [ebp - 0x70]
inc esi
cmp esi, eax
jl 0x407ca6
jmp 0x407d44
mov ecx, dword [ebp + 0xe8]
mov dword [ebp - 0x80], ecx
xor esi, esi
test eax, eax
jle 0x407ee6
mov eax, dword [edi + esi*4]
mov ecx, 0x6d5d68
mov edx, eax
mov bl, byte [ecx]
cmp bl, byte [edx]
mov byte [ebp - 0x55], bl
mov ebx, dword [ebp - 0x64]
jne 0x407d88
cmp byte [ebp - 0x55], 0
je 0x407d84
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x55], bl
mov ebx, dword [ebp - 0x64]
jne 0x407d88
add ecx, 2
add edx, 2
cmp byte [ebp - 0x55], 0
jne 0x407d58
xor ecx, ecx
jmp 0x407d8d
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x407ed9
mov edx, eax
mov ecx, 0x6d5d74
mov bl, byte [ecx]
cmp bl, byte [edx]
mov byte [ebp - 0x55], bl
mov ebx, dword [ebp - 0x64]
jne 0x407dcc
cmp byte [ebp - 0x55], 0
je 0x407dc8
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x55], bl
mov ebx, dword [ebp - 0x64]
jne 0x407dcc
add ecx, 2
add edx, 2
cmp byte [ebp - 0x55], 0
jne 0x407d9c
xor ecx, ecx
jmp 0x407dd1
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x407ed9
mov edx, eax
mov ecx, 0x6d5d80
mov bl, byte [ecx]
cmp bl, byte [edx]
mov byte [ebp - 0x55], bl
mov ebx, dword [ebp - 0x64]
jne 0x407e10
cmp byte [ebp - 0x55], 0
je 0x407e0c
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x55], bl
mov ebx, dword [ebp - 0x64]
jne 0x407e10
add ecx, 2
add edx, 2
cmp byte [ebp - 0x55], 0
jne 0x407de0
xor ecx, ecx
jmp 0x407e15
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x407ed9
mov edx, eax
mov ecx, 0x6d5d90
mov bl, byte [ecx]
cmp bl, byte [edx]
mov byte [ebp - 0x55], bl
mov ebx, dword [ebp - 0x64]
jne 0x407e54
cmp byte [ebp - 0x55], 0
je 0x407e50
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x55], bl
mov ebx, dword [ebp - 0x64]
jne 0x407e54
add ecx, 2
add edx, 2
cmp byte [ebp - 0x55], 0
jne 0x407e24
xor ecx, ecx
jmp 0x407e59
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x407ed9
mov edx, eax
mov ecx, 0x6d5da0
mov bl, byte [ecx]
cmp bl, byte [edx]
mov byte [ebp - 0x55], bl
mov ebx, dword [ebp - 0x64]
jne 0x407e94
cmp byte [ebp - 0x55], 0
je 0x407e90
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x55], bl
mov ebx, dword [ebp - 0x64]
jne 0x407e94
add ecx, 2
add edx, 2
cmp byte [ebp - 0x55], 0
jne 0x407e64
xor ecx, ecx
jmp 0x407e99
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x407ed9
mov ecx, 0x6d5dac
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x407ec2
test dl, dl
je 0x407ebe
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x407ec2
add ecx, 2
add eax, 2
test dl, dl
jne 0x407ea2
xor eax, eax
jmp 0x407ec9
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
je 0x407ed9
inc esi
cmp esi, dword [ebp - 0x70]
jl 0x407d4e
jmp 0x407ee6
push 0
xor ecx, ecx
call fcn.0048f23f
pop ecx
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x407f08
push 0
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, 0x6d5db8
call fcn.00403127
pop ecx
mov ecx, eax
call fcn.0048f23f
pop ecx
mov dword [ebx + 0x24], eax
xor eax, eax
xor ecx, ecx
and dword [ebp - 0x5c], eax
xor esi, esi
mov dword [ebp - 0x74], eax
xor edi, edi
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x68], ecx
mov dword [ebp + 0xd4], esi
test eax, eax
jle 0x408222
mov esi, dword [ebp - 0x6c]
cmp dword [esi + edi*4], 0
jne 0x407f39
and dword [ebp - 0x78], 0
jmp 0x407f4b
push 0x1000
push dword [esi + edi*4]
call fcn.005f01d0
pop ecx
pop ecx
mov dword [ebp - 0x78], eax
mov esi, dword [esi + edi*4]
mov ecx, 0x6d5dbc
mov edx, esi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x407f75
test al, al
je 0x407f71
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x407f75
add ecx, 2
add edx, 2
test al, al
jne 0x407f55
xor eax, eax
jmp 0x407f7c
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
mov ecx, dword [ebp + 0xd4]
test eax, eax
push 1
pop eax
cmove ecx, eax
mov eax, 0x6d5dc4
mov dword [ebp + 0xd4], ecx
mov ecx, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407fb7
test dl, dl
je 0x407fb3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407fb7
add eax, 2
add ecx, 2
test dl, dl
jne 0x407f97
xor eax, eax
jmp 0x407fbe
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
je 0x407ff9
mov ecx, esi
mov eax, 0x6d5dd0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407fec
test dl, dl
je 0x407fe5
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407fec
add eax, 2
add ecx, 2
test dl, dl
jne 0x407fc9
xor edx, edx
xor eax, eax
inc edx
jmp 0x407ff3
sbb eax, eax
xor edx, edx
inc edx
or eax, edx
test eax, eax
jne 0x407fff
jmp 0x407ffc
xor edx, edx
inc edx
mov dword [ebp - 0x74], edx
mov eax, 0x6d5de0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x408024
test cl, cl
je 0x408020
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x408024
add eax, 2
add esi, 2
test cl, cl
jne 0x408004
xor eax, eax
jmp 0x408028
sbb eax, eax
or eax, edx
test eax, eax
jne 0x40804a
mov ecx, dword [ebx + 0x24]
push 5
pop esi
push eax
push edx
push 0x6d5dec
push 0xd
mov edx, str._localService
call fcn.0048e714
add esp, 0x10
jmp 0x40804d
mov esi, dword [ebp - 0x74]
mov edx, dword [ebp - 0x6c]
mov eax, 0x6d5e00
mov edx, dword [edx + edi*4]
mov ecx, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
mov byte [ebp - 0x55], bl
mov ebx, dword [ebp - 0x64]
jne 0x40808a
cmp byte [ebp - 0x55], 0
je 0x408086
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
mov byte [ebp - 0x55], bl
mov ebx, dword [ebp - 0x64]
jne 0x40808a
add eax, 2
add ecx, 2
cmp byte [ebp - 0x55], 0
jne 0x40805a
xor eax, eax
jmp 0x408091
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
je 0x4080c5
mov eax, 0x6d5e0c
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4080ba
test cl, cl
je 0x4080b6
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4080ba
add eax, 2
add edx, 2
test cl, cl
jne 0x40809a
xor eax, eax
jmp 0x4080c1
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
jne 0x4080e7
mov ecx, dword [ebx + 0x24]
mov edx, str._deleteData
push 2
pop eax
mov esi, eax
xor eax, eax
push 0
inc eax
push eax
push 0x6d5e1c
push 0xb
call fcn.0048e714
add esp, 0x10
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, 0x6d5e2c
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x408112
test dl, dl
je 0x40810e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x408112
add eax, 2
add ecx, 2
test dl, dl
jne 0x4080f2
xor eax, eax
jmp 0x408119
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
mov edx, dword [ebp - 0x78]
test eax, eax
push 2
pop eax
cmove esi, eax
xor eax, eax
inc eax
mov dword [ebp - 0x74], esi
push eax
mov eax, dword [ebp - 0x6c]
push 0x6d5e38
mov ecx, dword [eax + edi*4]
call fcn.0048bd79
pop ecx
pop ecx
mov esi, eax
push 2
pop eax
cmp esi, eax
jle 0x40820d
push eax
mov eax, dword [ebp - 0x6c]
push 0x6d5e3c
push dword [eax + edi*4]
call fcn.005e88d0
add esp, 0xc
test eax, eax
jne 0x40820d
cmp esi, 0xa
jne 0x4081ca
mov eax, dword [ebp - 0x6c]
push 8
push str.readonly
push 2
mov eax, dword [eax + edi*4]
pop ecx
add eax, ecx
push eax
call fcn.005e88d0
add esp, 0xc
test eax, eax
jne 0x4081ca
inc eax
push eax
mov eax, dword [ebp - 0x6c]
push 0x6d5e4c
mov eax, dword [eax + edi*4]
add eax, 0xb
push eax
call fcn.005e88d0
add esp, 0xc
test eax, eax
jne 0x4081ca
inc eax
cmp dword [ebx + 0x24], 0
mov dword [ebp - 0x5c], eax
je 0x4081d0
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, 0x6d5e50
call fcn.00403127
pop ecx
mov ecx, dword [ebx + 0x24]
mov edx, eax
call fcn.0048f2c4
cmp dword [ebx + 0x24], 0
jne 0x4081dd
push 0
xor ecx, ecx
call fcn.0048f23f
pop ecx
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebx + 0x24]
push 0
mov edx, dword [eax + edi*4]
mov eax, dword [ebp - 0x78]
sub eax, esi
dec eax
push eax
lea eax, [esi + 1]
add eax, edx
add edx, 2
push eax
lea eax, [esi - 2]
push eax
call fcn.0048e714
mov ecx, dword [ebp - 0x68]
add esp, 0x10
inc ecx
mov dword [ebp - 0x68], ecx
jmp 0x408210
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x70]
inc edi
cmp edi, eax
jl 0x407f2a
mov esi, dword [ebp + 0xd4]
sub eax, ecx
cmp dword [ebx + 0x24], 0
mov dword [ebp - 0x70], eax
jne 0x40823a
push 0
xor ecx, ecx
call fcn.0048f23f
pop ecx
mov dword [ebx + 0x24], eax
mov eax, dword [ebx + 0x24]
mov edi, 0x400
cmp dword [eax], 0
jne 0x40826b
push edi
push 0x6d5e54
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, str.readmsh
push 0
push 0
push eax
call fcn.0048f7e4
add esp, 0x14
test eax, eax
je 0x4082e4
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, str..mshx
call fcn.00403127
pop ecx
mov edx, eax
mov ecx, ebx
call fcn.00407663
test eax, eax
jne 0x4082e4
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, 0x6d5e6c
call fcn.00403127
pop ecx
mov edx, eax
mov ecx, ebx
call fcn.00407663
test eax, eax
jne 0x4082e4
mov edx, str.mesh_linumshx
mov ecx, ebx
call fcn.00407663
test eax, eax
jne 0x4082e4
mov edx, str.mesh_limshx
mov ecx, ebx
call fcn.00407663
test eax, eax
jne 0x4082e4
xor edx, edx
mov ecx, ebx
call fcn.00407474
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, 0x6d5e90
call fcn.00403127
pop ecx
mov edx, eax
mov ecx, ebx
call fcn.00407663
push edi
push 0x6d5e98
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d5ea4
push 0
push 0
push eax
call fcn.0048f7e4
add esp, 0x14
test eax, eax
je 0x408372
push edi
push 0x6d5eb0
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, str.maxLogSize
push 0x1000
push 0x751940
push eax
call fcn.0048f7e4
add esp, 0x14
cmp eax, 0x1000
jae 0x408372
push 0xffffffffffffffff
push 0xffffffffffffffff
xorps xmm0, xmm0
mov edx, 0x751940
push ecx
lea ecx, [ebp + 0xd0]
movlpd qword [ebp + 0xd0], xmm0
call fcn.00484d12
add esp, 0xc
test eax, eax
jne 0x408372
mov eax, dword [ebp + 0xd0]
mov dword [0x73e1d0], eax
mov eax, dword [ebp + 0xd4]
mov dword [0x73e1d4], eax
xor ecx, ecx
cmp dword [ebx + 0xc28], ecx
jne 0x4083a4
push edi
push 0x6d5ec8
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, str.nocertstore
push 0
push 0
push eax
call fcn.0048f7e4
add esp, 0x14
mov dword [ebx + 0xc28], eax
xor ecx, ecx
test esi, esi
je 0x4083e4
push dword [ebx]
push 0x407b6d
push ecx
push dword [ebx + 0x1c]
push ecx
push ecx
push dword [ebx]
push ecx
call fcn.00479238
xor edx, edx
mov ecx, eax
call fcn.00479abd
add esp, 0x20
mov edx, str.require__agentStatus_.start___
push 0xe08
push ecx
mov ecx, eax
call fcn.00417a90
xor eax, eax
pop ecx
inc eax
jmp 0x409b02
mov edi, dword [ebp - 0x74]
test edi, edi
je 0x4085d1
push dword [ebx]
push 0x407b6d
push ecx
push dword [ebx + 0x1c]
push ecx
push ecx
push dword [ebx]
push ecx
call fcn.00479238
xor edx, edx
mov ecx, eax
call fcn.00479abd
mov esi, eax
push ebx
mov ecx, esi
call fcn.004030e7
add esp, 0x24
mov edx, 0x6d5f04
push 0xe08
push ecx
mov ecx, esi
call fcn.00417a90
pop ecx
pop ecx
or edx, 0xffffffff
mov ecx, esi
call fcn.00419473
test eax, eax
je 0x409b21
sub edi, 1
je 0x408515
sub edi, 1
je 0x408463
sub edi, 3
je 0x408515
mov ecx, esi
call fcn.0045bb3a
jmp 0x4085ea
push 0xe08
push ecx
mov edx, str.require_agent_installer__
mov ecx, esi
call fcn.00417a90
push str.fullUninstall
or edx, 0xffffffff
mov ecx, esi
call fcn.004181f4
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
mov ecx, esi
call fcn.004190e2
mov edx, dword [ebx + 0x24]
mov ecx, esi
call fcn.0047e5ff
or edx, 0xffffffff
mov ecx, esi
call fcn.00417a2a
xor eax, eax
xor ebx, ebx
push ebx
mov ecx, esi
lea edx, [eax + 1]
call fcn.0041702b
add esp, 0x14
test eax, eax
je 0x4085c2
push ebx
or edx, 0xffffffff
mov ecx, esi
mov edi, 0x6d5fd4
call fcn.0041a1c6
pop ecx
push 2
pop edx
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x4084f0
test cl, cl
je 0x4084ec
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x4084f0
add eax, edx
add edi, edx
test cl, cl
jne 0x4084d2
mov eax, ebx
jmp 0x4084f7
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
je 0x4085c2
push ebx
or edx, 0xffffffff
mov ecx, esi
call fcn.0041a1c6
push eax
push 0x6d6000
jmp 0x4085ba
push 0xe08
push ecx
mov edx, 0x6d5f50
mov ecx, esi
call fcn.00417a90
push str.fullInstall
or edx, 0xffffffff
mov ecx, esi
call fcn.004181f4
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
mov ecx, esi
call fcn.004190e2
mov edx, dword [ebx + 0x24]
mov ecx, esi
call fcn.0047e5ff
or edx, 0xffffffff
mov ecx, esi
call fcn.00417a2a
xor eax, eax
xor ebx, ebx
push ebx
mov ecx, esi
lea edx, [eax + 1]
call fcn.0041702b
add esp, 0x14
test eax, eax
je 0x4085c2
push ebx
or edx, 0xffffffff
mov ecx, esi
mov edi, 0x6d5f78
call fcn.0041a1c6
pop ecx
push 2
pop edx
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x40859e
test cl, cl
je 0x40859a
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x40859e
add eax, edx
add edi, edx
test cl, cl
jne 0x408580
mov eax, ebx
jmp 0x4085a5
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
je 0x4085c2
push ebx
or edx, 0xffffffff
mov ecx, esi
call fcn.0041a1c6
push eax
push 0x6d5fa4
call fcn.00401109
add esp, 0xc
mov ecx, esi
call fcn.0041bef7
xor eax, eax
inc eax
jmp 0x409b03
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x409a59
cmp dword [eax], ecx
jne 0x4085ea
cmp dword [ebp - 0x5c], 0
je 0x409a59
mov edx, dword [ebx]
call fcn.004925d2
mov dword [ebx + 0x20], eax
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x408644
push 0x400
push 0x6d6078
mov dword [eax + 0x1040], 0x407b94
mov dword [eax + 0x1044], ebx
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, str.semaphoreTrack
push 0
push 0
push eax
call fcn.0048f7e4
add esp, 0x14
test eax, eax
je 0x408644
and dword [0x74c950], 0
mov dword [0x74cbc8], 0x407c04
and dword [ebp - 0x5c], 0
lea eax, [ebp + 0xd4]
push eax
push 0xf003f
push 0
push 0x6d6098
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4086bf
lea eax, [ebp - 0x5c]
push eax
xor eax, eax
push eax
push eax
push eax
push 0x6d60b8
push dword [ebp + 0xd4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4086b3
cmp dword [ebp - 0x5c], eax
jbe 0x4086b3
push 0x6d60c4
push dword [ebp + 0xd4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x4086b3
push str.NodeID_will_reset__because_ResetNodeID_key_was_found_in_registry
call fcn.0048cb75
xor eax, eax
inc eax
pop ecx
mov dword [ebp - 0x7c], eax
push dword [ebp + 0xd4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push eax
push eax
push eax
push dword [ebx + 0x1c]
push eax
push eax
push dword [ebx]
push eax
call fcn.00479238
xor edx, edx
mov ecx, eax
call fcn.00479abd
add esp, 0x20
mov dword [ebp - 0x68], eax
mov edx, str.require_linux_pathfix____
push 0xf88
push ecx
mov ecx, eax
call fcn.00417a90
xor eax, eax
push 0x400
push 0x6d6130
mov dword [ebx + 0xd3c], eax
mov dword [ebx + 0xd40], eax
mov dword [ebx + 0xd44], eax
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d6140
push 0
push 0
push eax
call fcn.0048f7e4
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x40879e
lea edi, [esi + 1]
cmp edi, 0xffffffff
jae 0x408760
push 0xfffffffffffffffe
pop eax
sub eax, esi
je 0x408760
cmp edi, 0xffffffef
jae 0x408760
push 0x1327
xor eax, eax
inc eax
push 0x6d6150
push eax
lea eax, [esi + 0x11]
push eax
call fcn.005ed7c0
add esp, 0x10
jmp 0x408762
xor eax, eax
push 0
push 0
mov edx, edi
mov ecx, eax
call fcn.00484c1e
push 0x400
push 0x6d6168
mov dword [ebx + 0xd50], eax
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d6178
push esi
push dword [ebx + 0xd50]
push eax
call fcn.0048f7e4
add esp, 0x1c
jmp 0x4087a8
mov dword [ebx + 0xd50], 0x6d6188
push 0x400
push 0x6d6194
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d61a0
push 0
push 0
push eax
call fcn.0048f7e4
mov esi, eax
add esp, 0x14
test esi, esi
je 0x408840
lea edi, [esi + 1]
cmp edi, 0xffffffff
jae 0x408802
push 0xfffffffffffffffe
pop ecx
sub ecx, esi
je 0x408802
cmp edi, 0xffffffef
jae 0x408802
push 0x1335
xor eax, eax
inc eax
push 0x6d61ac
push eax
lea eax, [esi + 0x11]
push eax
call fcn.005ed7c0
add esp, 0x10
jmp 0x408804
xor eax, eax
push 0
push 0
mov edx, edi
mov ecx, eax
call fcn.00484c1e
push 0x400
push 0x6d61c4
mov dword [ebx + 0xd54], eax
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d61d0
push esi
push dword [ebx + 0xd54]
push eax
call fcn.0048f7e4
add esp, 0x1c
jmp 0x40884a
mov dword [ebx + 0xd54], str.MeshCentral
push dword [ebx + 0xd50]
mov esi, dword [ebp - 0x68]
push str.require_service_manager_.manager.getService__s_.isMe___
push esi
call fcn.0041b42e
add esp, 0xc
or edx, 0xffffffff
mov ecx, esi
call fcn.004195de
push 0xe88
push ecx
mov edx, str._function_foo____var_f__require_service_manager_.manager.getServiceType____switch_f_case_procd:_return_7___case_windows:_return_10___case_launchd:_return_3___case_freebsd:_return_5___case_systemd:_return_1___case_init:_return_2___case_upstart:_return_4___default:_return_0_____
mov ecx, esi
mov edi, eax
call fcn.00417a90
pop ecx
pop ecx
test eax, eax
jne 0x408899
push eax
push ecx
or edx, 0xffffffff
mov ecx, esi
call fcn.00418b46
pop ecx
pop ecx
mov dword [ebx + 0xd3c], eax
push 0xe88
push ecx
mov edx, edi
mov ecx, esi
call fcn.00417a90
pop ecx
pop ecx
test eax, eax
jne 0x4088be
or edx, 0xffffffff
mov ecx, esi
call fcn.00419473
mov dword [ebx + 0xd40], eax
mov edi, 0xe88
mov edx, str.require_user_sessions_.isRoot___
push edi
push ecx
mov ecx, esi
call fcn.00417a90
pop ecx
pop ecx
test eax, eax
jne 0x4088e7
or edx, 0xffffffff
mov ecx, esi
call fcn.00419473
mov dword [ebx + 0xd44], eax
cmp dword [ebx + 0xd40], 0
jne 0x4089d9
cmp dword [ebx + 0xd58], 0
je 0x4089d9
push edi
push ecx
mov edx, str.require_util_service_check___
mov ecx, esi
call fcn.00417a90
pop ecx
pop ecx
test eax, eax
jne 0x4089d9
or edx, 0xffffffff
mov ecx, esi
call fcn.00418cbb
test eax, eax
mov ecx, 0x6bc408
cmovne ecx, eax
call fcn.0041aab2
test al, 6
jne 0x4089d9
lea eax, [ebp - 0x5c]
or edx, edx
push eax
mov ecx, esi
call fcn.0041a1c6
push eax
push dword [ebx + 0xd50]
mov dword [ebp + 0xd4], eax
push str.Service_Name_Conflict:_Configured___s__but_is_actually___s_
call fcn.0048cb75
mov ecx, dword [ebx + 0xd50]
add esp, 0x10
call fcn.00484cd3
mov esi, dword [ebp - 0x5c]
lea edi, [esi + 1]
cmp edi, 0xffffffff
jae 0x40899f
push 0xfffffffffffffffe
pop eax
sub eax, esi
je 0x40899f
cmp edi, 0xffffffef
jae 0x40899f
push 0x135c
xor eax, eax
inc eax
push 0x6d63d0
push eax
lea eax, [esi + 0x11]
push eax
call fcn.005ed7c0
add esp, 0x10
jmp 0x4089a1
xor eax, eax
push 0
push 0
mov edx, edi
mov ecx, eax
call fcn.00484c1e
push esi
push dword [ebp + 0xd4]
mov dword [ebx + 0xd50], eax
mov ecx, eax
mov edx, dword [eax - 0x10]
call section..text
mov esi, dword [ebp - 0x68]
xor eax, eax
add esp, 0x10
mov edi, 0xe88
inc eax
mov dword [ebx + 0xd40], eax
push 0x400
push 0x6d63e8
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, str.skipmaccheck
push 0
push 0
push eax
call fcn.0048f7e4
add esp, 0x14
test eax, eax
jne 0x408b97
push edi
push ecx
mov edx, str._function__getMac____var_ret____var_ni__require_os_.networkInterfaces____for__var_f_in_ni___for__var_i_in_ni_f____if_ni_f__i_.type__ethernet__ni_f__i_.type__wireless__ret______ni_f__i_.mac________return_ret_______
mov ecx, esi
call fcn.00417a90
pop ecx
pop ecx
test eax, eax
jne 0x408b97
lea eax, [ebp - 0x5c]
or edx, 0xffffffff
push eax
mov ecx, esi
call fcn.0041958a
mov edi, dword [ebp - 0x5c]
mov esi, eax
mov dword [ebp - 0x74], esi
pop ecx
cmp edi, 0x13
jb 0x408b97
push 0x400
push 0x6d6500
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d6514
push 0
push 0
push eax
call fcn.0048f7e4
add esp, 0x14
mov dword [ebp - 0x5c], eax
test eax, eax
jne 0x408a82
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d6528
push eax
push edi
push esi
push 0x11
call fcn.0048f387
add esp, 0x10
jmp 0x408b97
xor esi, esi
test edi, edi
jle 0x408b97
mov ebx, dword [ebp - 0x74]
push 0x13
lea eax, [esi + ebx]
push 0x6d653c
push eax
call fcn.005e88d0
add esp, 0xc
test eax, eax
jne 0x408aad
add esi, 0x13
cmp esi, edi
jl 0x408a8f
mov ebx, dword [ebp - 0x64]
cmp esi, edi
jge 0x408b97
mov esi, dword [ebp - 0x5c]
and dword [ebp + 0xd4], 0
lea eax, [esi + 1]
cmp eax, 0xffffffdb
jae 0x408ad9
lea eax, [esi + 0x25]
call fcn.005b9800
mov ecx, esp
lea eax, [esi + 1]
jmp 0x408adb
xor ecx, ecx
xor edx, edx
inc edx
push edx
push 4
mov edx, eax
call fcn.00484c1e
push 0x400
push 0x6d6550
mov dword [ebp - 0x78], eax
lea ecx, [eax + 4]
mov dword [eax], ecx
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d6564
push esi
push dword [ebp - 0x78]
push eax
call fcn.0048f7e4
add esp, 0x1c
test esi, esi
jle 0x408b6a
mov esi, dword [ebp - 0x78]
mov ebx, dword [ebp - 0x5c]
push 0x13
push str._00:00:00:00:00:00_
push esi
call fcn.005e88d0
add esp, 0xc
test eax, eax
je 0x408b45
mov ecx, dword [ebp - 0x74]
mov edx, edi
push 0x13
push esi
call fcn.0048bd79
pop ecx
pop ecx
test eax, eax
jns 0x408b5d
mov eax, dword [ebp + 0xd4]
add esi, 0x13
add eax, 0x13
mov dword [ebp + 0xd4], eax
cmp eax, ebx
jl 0x408b1e
jmp 0x408b63
mov eax, dword [ebp + 0xd4]
cmp eax, ebx
mov ebx, dword [ebp - 0x64]
jl 0x408b97
push dword [ebp - 0x78]
mov esi, dword [ebp - 0x74]
push esi
push str.NodeID_will_reset__MAC_Address_Mismatch:__s_____s
call fcn.0048cb75
mov ecx, dword [ebx + 0x24]
xor eax, eax
push 0
push edi
inc eax
mov edx, str.LocalMacAddresses
push esi
push 0x11
mov dword [ebp - 0x7c], eax
call fcn.0048f387
add esp, 0x1c
mov ecx, dword [ebp - 0x68]
call fcn.0045bb3a
xor edi, edi
inc edi
cmp dword [ebp - 0x7c], edi
je 0x408bb2
mov ecx, ebx
call fcn.00403593
test eax, eax
je 0x408bc8
mov ecx, ebx
call fcn.00403248
test eax, eax
je 0x408bc8
push str.Certificate_error_r_n
call fcn.00401109
pop ecx
mov ecx, ebx
call fcn.00403919
test eax, eax
je 0x408bde
push str.Certificate_validation_error_r_n
call fcn.00401109
pop ecx
and dword [ebp - 0x5c], 0
mov edx, str..tag
push 0x1000
push ecx
mov ecx, dword [ebx + 0x1c]
call fcn.00403127
pop ecx
lea edx, [ebp - 0x5c]
mov ecx, eax
call fcn.0048349a
mov esi, dword [ebp - 0x5c]
mov ecx, dword [ebx + 0x24]
test esi, esi
je 0x408c26
push 0
push eax
push esi
push 3
mov edx, 0x6d6610
call fcn.0048f387
push edi
push esi
call fcn.005ed680
add esp, 0x18
jmp 0x408c33
push 3
mov edx, 0x6d6614
call fcn.0048fd3e
pop ecx
mov ecx, dword [ebx + 0x24]
lea eax, [ebp - 0x38]
push 0xff
push eax
push 0xf
mov edx, str.ignoreProxyFile
call fcn.0048f7e4
add esp, 0xc
test eax, eax
jne 0x408cac
and dword [ebp - 0x5c], eax
mov edx, str..proxy
push 0x400
push ecx
mov ecx, dword [ebx + 0x1c]
call fcn.00403127
pop ecx
lea edx, [ebp - 0x5c]
mov ecx, eax
call fcn.0048349a
mov esi, dword [ebp - 0x5c]
test esi, esi
je 0x408cac
mov ecx, dword [ebx + 0x24]
test eax, eax
jle 0x408c96
push 0
push eax
push esi
push 8
mov edx, 0x6d6630
call fcn.0048f387
add esp, 0x10
jmp 0x408ca3
push 8
mov edx, 0x6d663c
call fcn.0048fd3e
pop ecx
push edi
push esi
call fcn.005ed680
pop ecx
pop ecx
and dword [ebp - 0x5c], 0
mov esi, 0x400
push esi
push 0x6d6648
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d665c
push 0
push 0
push eax
call fcn.0048f7e4
add esp, 0x14
cmp eax, 4
jne 0x408d0b
push esi
push 0x6d6670
call fcn.005f01d0
push 4
lea ecx, [ebp - 0x5c]
mov edx, str.AgentCapabilities
push ecx
mov ecx, dword [ebx + 0x24]
push eax
call fcn.0048f7e4
add esp, 0x14
push dword [ebp - 0x5c]
call dword [sym.imp.WS2_32.dll_ntohl]
or dword [ebx + 0x254], eax
push dword [ebx + 0xd50]
push 0x6d6698
push 0
push 0
call fcn.0040119b
mov esi, eax
add esp, 0x10
lea edi, [esi + 1]
cmp edi, 0xffffffff
jae 0x408d54
push 0xfffffffffffffffe
pop ecx
sub ecx, esi
je 0x408d54
cmp edi, 0xffffffef
jae 0x408d54
push 0x13d0
xor eax, eax
inc eax
push 0x6d66b0
push eax
lea eax, [esi + 0x11]
push eax
call fcn.005ed7c0
add esp, 0x10
jmp 0x408d56
xor eax, eax
push 0
push 0
mov edx, edi
mov ecx, eax
call fcn.00484c1e
push dword [ebx + 0xd50]
mov edi, eax
push str.SoftwareOpen_Source_s
mov dword [ebp - 0x5c], edi
push dword [edi - 0x10]
push edi
call fcn.0040119b
add esp, 0x18
xor eax, eax
push eax
push eax
push 0xffffffffffffffff
push edi
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax + 1]
lea eax, [edi + edi]
cmp eax, 0xffffffef
jae 0x408dbd
push 0x13d3
xor eax, eax
inc eax
push 0x6d66e0
push eax
lea eax, [edi*2 + 0x10]
push eax
call fcn.005ed7c0
add esp, 0x10
jmp 0x408dbf
xor eax, eax
push 0
push 0
lea edx, [edi + edi]
mov ecx, eax
call fcn.00484c1e
pop ecx
pop ecx
mov ecx, bind
mov dword [ebp - 0x7c], eax
cmp edi, ecx
jae 0x40924f
cmp esi, ecx
ja 0x40924f
lea ecx, [edi + 1]
mov edx, esi
push ecx
mov ecx, dword [ebp - 0x5c]
push eax
call fcn.004846c9
pop ecx
pop ecx
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebx + 0xd68]
push dword [ebp - 0x7c]
neg eax
sbb eax, eax
add eax, reloc.WS2_32.dll_bind
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40924f
and dword [ebp - 0x68], eax
lea eax, [ebp - 0x68]
test byte [ebx + 0x254], 0x40
push eax
push 0x30
pop edx
jne 0x409157
lea ecx, [ebx + 0xcec]
call fcn.0048a610
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, eax
pop ecx
test edx, edx
jle 0x408e9d
mov esi, dword [ebp - 0x68]
test esi, esi
je 0x408e9d
xor eax, eax
test edx, edx
jle 0x408e75
mov cl, byte [eax + esi]
cmp cl, 0x2b
jne 0x408e67
mov byte [eax + esi], 0x40
jmp 0x408e70
cmp cl, 0x2f
jne 0x408e70
mov byte [eax + esi], 0x24
inc eax
cmp eax, edx
jl 0x408e59
push edx
push esi
xor eax, eax
inc eax
push eax
push 0
push 0x6d66f8
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
inc eax
push eax
push esi
call fcn.005ed680
and dword [ebp - 0x68], 0
pop ecx
pop ecx
jmp 0x408ea7
push str.NodeId
push dword [ebp - 0x60]
call edi
mov esi, 0x751940
lea ecx, [ebx + 0xbc8]
push esi
push 0x30
pop edx
call fcn.00483219
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408ec0
sub ecx, edx
xor eax, eax
push ecx
push esi
inc eax
push eax
push 0
push str.AgentHash
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x400
push 0x6d6714
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d671c
push 0
push 0
push eax
call fcn.0048f7e4
add esp, 0x14
mov esi, 0x752940
test eax, eax
jne 0x408f16
push 0x6d6724
jmp 0x408fab
push 0x400
push 0x6d672c
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d6734
push 0x10000
push esi
push eax
call fcn.0048f7e4
add esp, 0x14
test eax, eax
jle 0x408fa6
lea ecx, [ebp - 0x68]
mov edx, eax
push ecx
mov ecx, esi
call fcn.0048a610
mov edx, eax
pop ecx
test edx, edx
jle 0x408f9f
mov esi, dword [ebp - 0x68]
test esi, esi
je 0x408f9f
xor ecx, ecx
test edx, edx
jle 0x408f7b
mov al, byte [ecx + esi]
cmp al, 0x2b
jne 0x408f6e
mov byte [ecx + esi], 0x40
jmp 0x408f76
cmp al, 0x2f
jne 0x408f76
mov byte [ecx + esi], 0x24
inc ecx
cmp ecx, edx
jl 0x408f61
push edx
push esi
xor eax, eax
inc eax
push eax
push 0
push 0x6d673c
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
inc eax
push eax
push esi
call fcn.005ed680
pop ecx
pop ecx
jmp 0x408fb0
push 0x6d6744
jmp 0x408fab
push str.MeshId
push dword [ebp - 0x60]
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
push 0x19
push 0x6d6754
inc eax
push eax
push 0
push str.CommitDate
push dword [ebp - 0x60]
call esi
push 0x400
push 0x6d677c
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d6788
push 0x10000
push 0x752940
push eax
call fcn.0048f7e4
add esp, 0x14
test eax, eax
jne 0x409007
push 0x6d6794
push dword [ebp - 0x60]
call edi
jmp 0x40902e
mov ecx, 0x752940
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40900f
sub ecx, edx
xor eax, eax
push ecx
push 0x752940
inc eax
push eax
push 0
push str.MeshServerUrl
push dword [ebp - 0x60]
call esi
push 0x400
push 0x6d67b4
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d67c0
push 0x10000
push 0x752940
push eax
call fcn.0048f7e4
add esp, 0x14
test eax, eax
jne 0x409068
push 0x6d67cc
push dword [ebp - 0x60]
call edi
jmp 0x40908f
mov ecx, 0x752940
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409070
sub ecx, edx
xor eax, eax
push ecx
push 0x752940
inc eax
push eax
push 0
push str.MeshServerId
push dword [ebp - 0x60]
call esi
push 0x400
push 0x6d67ec
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, str.WebProxy
push 0x10000
push 0x752940
push eax
call fcn.0048f7e4
add esp, 0x14
test eax, eax
jne 0x4090c9
push 0x6d6804
push dword [ebp - 0x60]
call edi
jmp 0x4090f0
mov ecx, 0x752940
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4090d1
sub ecx, edx
xor eax, eax
push ecx
push 0x752940
inc eax
push eax
push 0
push str.Proxy
push dword [ebp - 0x60]
call esi
push 0x400
push 0x6d6814
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d6818
push 0x10000
push 0x752940
push eax
call fcn.0048f7e4
add esp, 0x14
test eax, eax
jne 0x40912a
push 0x6d681c
push dword [ebp - 0x60]
call edi
jmp 0x40914f
mov edi, 0x752940
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409134
sub ecx, edx
xor eax, eax
push ecx
push edi
inc eax
push eax
push 0
push 0x6d6820
push dword [ebp - 0x60]
call esi
lea edi, [ebx + 0xcec]
jmp 0x4091c4
lea edi, [ebx + 0xcec]
mov ecx, edi
call fcn.0048a610
pop ecx
test eax, eax
jle 0x4091b6
mov esi, dword [ebp - 0x68]
test esi, esi
je 0x4091b6
xor ecx, ecx
test eax, eax
jle 0x409192
mov dl, byte [ecx + esi]
cmp dl, 0x2b
jne 0x409184
mov byte [ecx + esi], 0x40
jmp 0x40918d
cmp dl, 0x2f
jne 0x40918d
mov byte [ecx + esi], 0x24
inc ecx
cmp ecx, eax
jl 0x409176
push eax
push esi
xor eax, eax
inc eax
push eax
push 0
push 0x6d6824
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
inc eax
push eax
push esi
call fcn.005ed680
pop ecx
pop ecx
jmp 0x4091c4
push str.DiagnosticAgentNodeId
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, 0x400
push esi
push 0x6d6854
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, str.SelfNodeCert
push 0
push 0
push eax
call fcn.0048f7e4
add esp, 0x14
test eax, eax
jne 0x409246
push esi
push 0x6d6874
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov esi, 0x751940
push 0x1000
push esi
push eax
mov edx, 0x6d687c
call fcn.0048f7e4
add esp, 0x14
test eax, eax
je 0x40922f
cmp eax, 0x30
jne 0x40922f
xor ecx, ecx
mov eax, dword [edi + ecx*4]
cmp eax, dword [esi + ecx*4]
jne 0x40922f
inc ecx
cmp ecx, 0xc
jne 0x40921f
jmp 0x409246
mov ecx, dword [ebx + 0x24]
mov edx, str.NodeID
push 0
push 0x30
push edi
push 6
call fcn.0048f387
add esp, 0x10
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x5c]
call fcn.00484cd3
mov ecx, dword [ebp - 0x7c]
call fcn.00484cd3
lea edx, [ebx + 0xc3c]
cmp dword [edx], 0
push ecx
mov ecx, dword [ebx + 0x20]
jne 0x409274
push 0
xor edx, edx
jmp 0x40927a
push dword [ebx + 0xc30]
call fcn.004931d8
mov eax, dword [ebp - 0x80]
pop ecx
pop ecx
test eax, eax
je 0x409312
mov eax, dword [ebp - 0x70]
xor esi, esi
inc esi
cmp eax, esi
je 0x409312
push 2
pop edi
cmp eax, edi
jne 0x40930b
mov eax, dword [ebp - 0x6c]
mov edx, 0x6d688c
mov ecx, dword [eax + 4]
mov eax, ecx
mov bl, byte [eax]
cmp bl, byte [edx]
mov byte [ebp - 0x55], bl
mov ebx, dword [ebp - 0x64]
jne 0x4092d8
cmp byte [ebp - 0x55], 0
je 0x4092d4
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x55], bl
mov ebx, dword [ebp - 0x64]
jne 0x4092d8
add eax, edi
add edx, edi
cmp byte [ebp - 0x55], 0
jne 0x4092aa
xor eax, eax
jmp 0x4092dc
sbb eax, eax
or eax, esi
test eax, eax
je 0x409312
mov eax, 0x6d6890
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x409303
test dl, dl
je 0x4092ff
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x409303
add ecx, edi
add eax, edi
test dl, dl
jne 0x4092e5
xor eax, eax
jmp 0x409307
sbb eax, eax
or eax, esi
test eax, eax
je 0x409312
xor eax, eax
jmp 0x409b03
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, str..update.exe
call fcn.00403127
pop ecx
mov ecx, eax
call fcn.00483581
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, str..corereset
call fcn.00403127
mov dword [esp], 0x1000
mov edi, 0x74e940
push edi
push 0xffffffffffffffff
mov esi, eax
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push edi
call fcn.0060a1b0
mov edi, 0x400
pop ecx
pop ecx
test eax, eax
jne 0x40938b
push edi
push 0x6d68b0
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d68bc
push eax
call fcn.0048fd3e
add esp, 0xc
mov ecx, esi
call fcn.00483581
cmp dword [ebx + 0x248], 0
jne 0x4093b8
push edi
push 0x6d68c8
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d68d4
push 0
push 0
push eax
call fcn.0048f7e4
add esp, 0x14
mov esi, eax
jmp 0x4093ba
xor esi, esi
push edi
push 0x6d68e0
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d68ec
push 0
push 0
push eax
call fcn.0048f7e4
add esp, 0x14
test eax, eax
je 0x409449
push edi
push 0x6d68f8
call fcn.005f01d0
push 0x10
lea ecx, [ebp + 0xc8]
mov edx, str.jsDebugPort
push ecx
mov ecx, dword [ebx + 0x24]
push eax
call fcn.0048f7e4
add esp, 0x14
lea ecx, [eax - 1]
cmp ecx, 0xe
ja 0x409449
cmp eax, 0x10
jae 0x409b33
lea ecx, [ebp + 0xc8]
mov byte [ebp + eax + 0xc8], 0
call fcn.00484daf
test edx, edx
ja 0x409441
jb 0x409434
cmp eax, 0x7fffffff
ja 0x409441
lea ecx, [ebp + 0xc8]
call fcn.00484ddc
jmp 0x409443
xor eax, eax
mov dword [ebx + 0xbb8], eax
xor edi, edi
push 0x400
inc edi
push 0x6d6910
mov dword [ebx + 0x24c], edi
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, str.showModuleNames
push 0
push 0
push eax
call fcn.0048f7e4
add esp, 0x14
mov dword [0x74ca64], eax
cmp dword [ebx + 8], 0
je 0x4094d8
push dword [ebx]
push dword [ebx + 8]
call fcn.004029d9
mov ecx, dword [ebx + 8]
or edx, 0xffffffff
push 0x6d6930
call fcn.004181f4
mov ecx, dword [ebx + 8]
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
call fcn.004190e2
mov ecx, dword [ebx + 8]
mov edx, str.Ready
call fcn.0041b0d2
mov ecx, dword [ebx + 8]
mov edx, edi
push 0
call fcn.0041702b
add esp, 0x14
test eax, eax
je 0x4094d0
mov ecx, dword [ebx + 8]
call fcn.0045babb
mov ecx, dword [ebx + 8]
call fcn.0041bef7
xor eax, eax
cmp dword [ebx + 0x248], eax
jne 0x40969c
push eax
push eax
push dword [ebx + 0x18]
push dword [ebx + 0x1c]
push dword [ebx + 0x24]
push eax
push dword [ebx]
push eax
call fcn.00479238
xor edx, edx
mov ecx, eax
call fcn.00479abd
push ebx
mov ecx, eax
mov dword [ebx + 8], eax
call fcn.004030e7
mov ecx, dword [ebx + 8]
mov edx, 0x4079bd
push ebx
call fcn.0045b83e
push 0x400
push 0x6d6940
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, str.coreDumpEnabled
push 0
push 0
push eax
call fcn.0048f7e4
add esp, 0x3c
mov dword [ebx + 0xbbc], eax
test eax, eax
je 0x40955f
push 0xf08
push ecx
mov ecx, dword [ebx + 8]
mov edx, str.process.coreDumpLocation__process.platformwin32__process.execPath.replace_.exe__.dmp__:_process.execPath__.dmp__
call fcn.00417a90
pop ecx
pop ecx
push 0x400
push 0x6d69e0
call fcn.005f01d0
push 0x1000
mov ecx, 0x751940
mov edx, str.finalizer_messages
push ecx
mov ecx, dword [ebx + 0x24]
push eax
call fcn.0048f7e4
add esp, 0x14
test eax, eax
je 0x40959f
mov eax, 0x751940
push eax
call fcn.005ef810
pop ecx
mov dword [0x74cb90], eax
cmp esi, 4
jle 0x40969c
push 0x400
push 0x6d6a08
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, str.noUpdateCoreModule
push 0
push 0
push eax
call fcn.0048f7e4
add esp, 0x14
test eax, eax
je 0x40964d
push str._CoreModule:_Update_Disabled_n
mov dword [ebx + 0x248], edi
call fcn.00401109
push 0
push 0
xor edx, edx
mov ecx, esi
call fcn.00484ef6
push 0x400
push 0x6d6a54
mov edi, eax
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d6a60
push esi
push edi
push eax
call fcn.0048f7e4
mov ecx, dword [ebx + 8]
lea eax, [esi - 4]
push 0xd
push 0x6d6a6c
push eax
lea edx, [edi + 4]
call fcn.00479fee
add esp, 0x2c
test eax, eax
jne 0x409637
mov ecx, dword [ebx + 8]
call fcn.0047a077
test eax, eax
je 0x40963f
mov ecx, dword [ebx + 8]
call fcn.0041bef7
xor eax, eax
inc eax
push eax
push edi
call fcn.005ed680
pop ecx
pop ecx
jmp 0x40969c
mov ecx, dword [ebx + 8]
lea edx, [ebp - 0x5c]
sub esp, 0xc
mov dword [ebp - 0x5c], ebx
call fcn.0045bedd
mov ecx, dword [ebx + 8]
mov dword [ebx + 0xbb4], eax
call fcn.0041b2dd
mov edx, dword [ebx + 0xbb4]
mov ecx, dword [ebx + 8]
call fcn.0041bc07
mov ecx, dword [ebx + 0xbb4]
call fcn.0045b1bd
mov ecx, dword [ebx + 8]
push eax
push 0xfffffffffffffffe
pop edx
call fcn.00418449
mov ecx, dword [ebx + 8]
add esp, 0x10
call fcn.0041bef7
mov edi, 0x400
push edi
push 0x6d6a7c
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d6a84
push 0
push 0
push eax
call fcn.0048f7e4
add esp, 0x14
test eax, eax
jle 0x40972b
push edi
push 0x6d6a8c
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov esi, 0x751940
push 0x1000
push esi
push eax
mov edx, str.exitPID
call fcn.0048f7e4
add esp, 0x14
mov ecx, esi
call fcn.00484ddc
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40972b
mov edx, 0x14ce
mov ecx, 0x6d6a9c
call fcn.00487300
mov ecx, dword [ebx]
mov edx, esi
push eax
push ebx
push 0x407b82
push 0xffffffffffffffff
call fcn.00487bda
add esp, 0x10
push edi
push 0x6d6ab4
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, str.hideConsole
push 0
push 0
push eax
call fcn.0048f7e4
add esp, 0x14
test eax, eax
jle 0x409768
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x409768
push 0xf88
push ecx
mov edx, str.require_win_console_.hide__
call fcn.00417a90
pop ecx
pop ecx
push edi
push 0x6d6aec
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, str.selfTest
push 0
push 0
push eax
call fcn.0048f7e4
add esp, 0x14
test eax, eax
jne 0x40979a
mov ecx, dword [ebx]
mov edx, 0x4079ce
push ebx
call fcn.00483ce0
pop ecx
cmp dword [ebx + 0xbc4], 0
jne 0x4097af
mov ecx, ebx
call fcn.00406fea
jmp 0x409857
push edi
push 0x6d6b04
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d6b10
push 0
push 0
push eax
call fcn.0048f7e4
mov esi, eax
add esp, 0x14
cmp esi, 4
jle 0x409842
push 0
push 0
xor edx, edx
mov ecx, esi
call fcn.00484ef6
push 0x400
push 0x6d6b1c
mov edi, eax
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d6b28
push esi
push edi
push eax
call fcn.0048f7e4
mov ecx, dword [ebx + 8]
lea eax, [esi - 4]
push 0xd
push 0x6d6b34
push eax
lea edx, [edi + 4]
call fcn.00479fee
add esp, 0x28
test eax, eax
jne 0x409829
mov ecx, dword [ebx + 8]
call fcn.0047a077
mov ecx, dword [ebx + 8]
call fcn.0041bef7
xor eax, eax
inc eax
push eax
push edi
call fcn.005ed680
pop ecx
pop ecx
mov edi, 0x400
push 0xf88
push ecx
mov ecx, dword [ebx + 8]
mov edx, str.console.log_Agent_running_in_Local_Debug_Mode__require_MeshAgent_.emit_Connected_1__
call fcn.00417a90
pop ecx
pop ecx
push edi
push 0x6d6b44
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov esi, 0x751940
push 0x1000
push esi
push eax
mov edx, 0x6d6bac
call fcn.0048f7e4
add esp, 0x14
cmp eax, 5
jle 0x4085c9
mov eax, dword [esi]
mov ecx, 0x6d6bb8
cmp eax, dword [ecx]
jne 0x4085c9
movzx eax, byte [esi + 4]
cmp al, byte [ecx + 4]
jne 0x4085c9
push edi
push 0x6d6bc0
call fcn.005f01d0
mov ecx, dword [ebx + 0x24]
mov edx, str.DiscoveryKey
push 0x1000
push esi
push eax
call fcn.0048f7e4
xor edi, edi
mov esi, eax
inc edi
add esp, 0x14
cmp esi, edi
jle 0x40995b
lea eax, [ebp - 0x14]
push eax
call fcn.004a7b60
lea eax, [esi - 1]
mov esi, 0x751940
push eax
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.004a7c10
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.004a7b50
push 0x14ff
push 0x6d6be0
push edi
push 0x20
call fcn.005ed7c0
add esp, 0x28
mov dword [ebx + 0xd28], eax
test eax, eax
jne 0x40994f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x14ff
push esi
push edi
mov edx, 0x6d6bf8
xor ecx, ecx
call fcn.0048cac3
push edi
push 0x6d6c10
push 0x6d6c28
call fcn.00401109
add esp, 0x18
push esi
jmp 0x409b2e
push 8
pop ecx
mov esi, 0x751940
mov edi, eax
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea edi, [ebp + 0xc8]
stosd dword es:[edi], eax
push 7
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
call fcn.0048c5ff
mov esi, dword [sym.imp.WS2_32.dll_htons]
test eax, eax
je 0x4099a3
push 0x17
pop edi
push 0x425d
mov word [ebp - 0x54], di
call esi
mov word [ebp - 0x52], ax
mov edx, str.FF02:0:0:0:0:0:0:FE
lea eax, [ebp - 0x4c]
mov ecx, edi
push eax
call fcn.0048c79c
pop ecx
push 2
pop edi
push 0x425d
mov word [ebp + 0xc8], di
call esi
mov word [ebp + 0xca], ax
mov edx, str.239.255.255.235
lea eax, [ebp + 0xcc]
mov ecx, edi
push eax
call fcn.0048c79c
push ebx
push ecx
mov ecx, dword [ebx]
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0xc8]
push eax
push 0x425e
call fcn.004842b3
add esp, 0x18
mov dword [ebx + 0xd20], eax
test eax, eax
jne 0x409a19
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xdb
push 0x1517
mov edx, 0x6d6c70
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
jmp 0x4085c9
push ecx
push ebx
push ecx
mov ecx, dword [ebx]
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0xc8]
push eax
push 0
call fcn.004842b3
add esp, 0x18
mov dword [ebx + 0xd24], eax
test eax, eax
jne 0x4085c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xdb
push 0x151b
mov edx, 0x6d6c88
jmp 0x409a0a
push ecx
push ecx
push 0x12c9
xor edi, edi
push 0x6d6004
inc edi
push edi
push 0x20
call fcn.005ed7c0
add esp, 0x10
mov ecx, eax
push 0x10
pop edx
call fcn.00484c1e
mov esi, eax
mov eax, dword [ebp - 0x70]
pop ecx
pop ecx
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x6c]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x80]
mov dword [esi], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x409aa5
call fcn.0048f331
and dword [ebx + 0x24], 0
mov eax, dword [ebx + 0xd38]
cmp eax, 0xa
je 0x409af6
inc eax
push eax
push str.Unable_to_open_database___d_10_..._r_n
call fcn.00401109
inc dword [ebx + 0xd38]
pop ecx
pop ecx
mov ecx, dword [ebx]
push 0
push 0x12dd
push 0x6d6060
push 0x406199
push 0x407a4c
push 0x7d0
call fcn.0048546a
mov edx, esi
mov ecx, eax
call fcn.0048a8a3
add esp, 0x18
mov eax, edi
jmp 0x409b03
push str.Unable_to_open_database._r_n
call fcn.00401109
xor eax, eax
pop ecx
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xd8]
xor ecx, ebp
call fcn.005b8900
lea esp, [ebp + 0xdc]
pop ebp
ret
push str.___Administrator_permissions_needed..._n
call fcn.00401109
pop ecx
push 0
call fcn.005c8390
call fcn.005b8a60
int3