Function at 0x4c9ee0
Capabilities:
Copy file
Delete registry key
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x6e0]
sub esp, 0x6e0
push 0xfffffffffffffffe
push 0x5fbc10
push 0x587100
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x6009e4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x6dc], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0x6ec]
mov dword [ebp - 0x2c], 0
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov edi, dword [ebp + 0x6e8]
cmp edi, 1
jle 0x4c9f7f
push 0x620c24
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4c9f7f
push str.Feb__6_2019
push str.18:22:45
push str.Compiled_on:__s___s_n
call fcn.004010e0
push ebx
call fcn.004e6650
push eax
push str.Using__s_n
call fcn.004010e0
add esp, 0x18
jmp 0x4c9fd0
cmp edi, 2
jle 0x4ca03e
push str._faddr
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4c9ff5
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x24]
push eax
push 0x620c70
mov eax, dword [esi + 8]
add eax, 2
push eax
call fcn.00408920
push 0
push dword [ebp - 0x24]
call fcn.004af1e0
push 0x6247a0
push 0x620c74
call fcn.004010e0
add esp, 0x1c
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x6dc]
xor ecx, ebp
call fcn.00584a28
lea esp, [ebp + 0x6e0]
pop ebp
ret
cmp edi, 2
jle 0x4ca03e
push str._fdelta
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4ca03e
xorps xmm0, xmm0
movlpd qword [ebp - 0x30], xmm0
lea eax, [ebp - 0x30]
push eax
push str._lld
push dword [esi + 8]
call fcn.00408920
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.004af1b0
push 0x6247a0
push 0x620c88
jmp 0x4c9fc8
push 0x104
lea eax, [ebp + 0x3d0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x1c]
lea ecx, [ebp + 0x3d0]
call fcn.0049a8c0
add esp, 4
cmp edi, 2
jle 0x4ca0df
mov ecx, str._exec
mov eax, dword [esi + 4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4ca094
test dl, dl
je 0x4ca090
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4ca094
add eax, 2
add ecx, 2
test dl, dl
jne 0x4ca074
xor eax, eax
jmp 0x4ca099
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4ca0df
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x4ca0d5
or edx, 0xffffffff
mov ecx, dword [esi + 8]
call fcn.004b3f30
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jne 0x4ca0c0
mov dword [ebp - 0x24], eax
jmp 0x4ca0eb
push 0x1000
push ebx
call fcn.0058cca6
add esp, 8
mov dword [ebp - 0x24], eax
xor ebx, ebx
jmp 0x4ca0eb
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
xor ebx, ebx
jmp 0x4ca0eb
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
xor ecx, ecx
mov dword [ebp - 0x28], ecx
test edi, edi
jle 0x4ca172
nop
mov eax, dword [esi + ecx*4]
test eax, eax
je 0x4ca16a
push 0x103
push eax
call fcn.0058cca6
add esp, 8
mov ebx, eax
mov ecx, dword [ebp - 0x28]
cmp ebx, 7
jbe 0x4ca1df
mov edx, dword [esi + ecx*4]
mov eax, dword [edx]
cmp eax, dword [str._proxy:]
jne 0x4ca1df
movzx eax, word [edx + 4]
mov edi, str._proxy:
cmp ax, word [edi + 4]
mov edi, dword [ebp + 0x6e8]
jne 0x4ca1df
movzx eax, byte [edx + 6]
mov edi, str._proxy:
cmp al, byte [edi + 6]
mov edi, dword [ebp + 0x6e8]
jne 0x4ca1df
lea eax, [edx + 7]
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, edi
jl 0x4ca100
cmp edi, 1
jle 0x4ca285
push str._kvm0
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4ca234
push 0xc
call fcn.0058d200
add esp, 4
test eax, eax
jne 0x4ca20e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x61c4e8
xor ecx, ecx
call fcn.004b47e0
push 0x4c4
push 0x61c504
push 0x61c520
call fcn.004010e0
add esp, 0x18
push 0xfe
call fcn.00587d2d
cmp ebx, 5
jb 0x4ca167
mov edx, dword [esi + ecx*4]
mov ebx, str._tag:
mov eax, dword [edx]
cmp eax, dword [ebx]
jne 0x4ca167
movzx eax, byte [edx + 4]
cmp al, byte [ebx + 4]
jne 0x4ca167
lea ebx, [edx + 5]
mov dword [ebp - 0x20], ebx
jmp 0x4ca16a
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [eax], 0x4c9e70
mov dword [eax + 8], 0
push eax
call fcn.00409a50
jmp 0x4c9fd0
cmp edi, 1
jle 0x4ca285
push str._kvm1
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4ca285
push 0xc
call fcn.0058d200
add esp, 4
test eax, eax
je 0x4ca1a1
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [eax], 0x4c9e70
mov dword [eax + 8], 1
push eax
call fcn.00409a50
jmp 0x4c9fd0
cmp dword [ebp - 0x1c], 0
jne 0x4cae4e
test edi, edi
jle 0x4ca2aa
push 0x620cb4
push dword [esi]
call fcn.005941fc
add esp, 8
test eax, eax
je 0x4cae4e
cmp edi, 1
jle 0x4ca985
push 0x620cbc
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
je 0x4cae4e
push 0x620cc0
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
je 0x4cae4e
push str.__slave
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
je 0x4cae4e
cmp edi, 1
jle 0x4ca985
push str.state
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4ca3eb
call fcn.004c9050
mov esi, eax
cmp esi, 1
jne 0x4ca33c
push 0x620cec
call fcn.004010e0
add esp, 4
mov eax, esi
jmp 0x4c9fd2
cmp esi, 2
jne 0x4ca355
push 0x620cf4
call fcn.004010e0
add esp, 4
mov eax, esi
jmp 0x4c9fd2
cmp esi, 3
jne 0x4ca36e
push 0x620d04
call fcn.004010e0
add esp, 4
mov eax, esi
jmp 0x4c9fd2
cmp esi, 4
jne 0x4ca387
push 0x620d14
call fcn.004010e0
add esp, 4
mov eax, esi
jmp 0x4c9fd2
cmp esi, 5
jne 0x4ca3a0
push 0x620d1c
call fcn.004010e0
add esp, 4
mov eax, esi
jmp 0x4c9fd2
cmp esi, 6
jne 0x4ca3b9
push 0x620d30
call fcn.004010e0
add esp, 4
mov eax, esi
jmp 0x4c9fd2
cmp esi, 7
jne 0x4ca3d2
push 0x620d40
call fcn.004010e0
add esp, 4
mov eax, esi
jmp 0x4c9fd2
cmp esi, 0x64
jne 0x4ca3e4
push str.Not_installed
call fcn.004010e0
add esp, 4
mov eax, esi
jmp 0x4c9fd2
cmp edi, 1
jle 0x4ca985
push str._signcheck
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4ca449
push 0x104
lea eax, [ebp + 0x2cc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 5
jbe 0x4ca449
call fcn.004acd70
lea ecx, [ebp + 0x2cc]
call fcn.0040bb40
push eax
push 0x620d64
call fcn.004010e0
add esp, 8
call fcn.004ace50
jmp 0x4c9fd0
cmp edi, 1
jle 0x4ca985
push str.start
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
je 0x4ca47a
push str._start
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4ca4d9
call fcn.004c90d0
test eax, eax
jne 0x4ca49b
push str.Failed_to_start_mesh_agent
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
cmp eax, 1
jne 0x4ca4b8
push str.Started_the_mesh_agent
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
cmp eax, 2
jne 0x4cae43
push str.Mesh_agent_already_running
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
cmp edi, 1
jle 0x4ca985
push str.stop
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
je 0x4ca50a
push str._stop
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4ca544
call fcn.004c9160
cmp eax, 1
jne 0x4ca52c
push str.Stopped_mesh_agent
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
push str.Failed_to_stop_mesh_agent
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
cmp edi, 1
jle 0x4ca985
push str.restart
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
je 0x4ca575
push str._restart
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4ca5d9
call fcn.004c9160
call fcn.004c90d0
test eax, eax
jne 0x4ca59b
push str.Failed_to_restart_mesh_agent
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
cmp eax, 1
jne 0x4ca5b8
push str.Restarted_the_mesh_agent
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
cmp eax, 2
jne 0x4cae43
push str.Mesh_agent_failed_to_stop
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
cmp edi, 1
jle 0x4ca985
push str._install
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4ca66b
call fcn.004c9160
mov ecx, str.Mesh_Agent
call fcn.004c8fc0
mov ecx, 0x620704
call fcn.004c8fc0
call fcn.004c8e80
cmp eax, 1
jne 0x4ca620
push str.Mesh_agent_installed
jmp 0x4ca625
push str.Failed_to_install_mesh_agent
call fcn.004010e0
add esp, 4
push 0x104
lea eax, [ebp + 0x4d4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 5
jbe 0x4cae43
lea ecx, [ebp + 0x4d4]
call fcn.004c84e0
lea ecx, [ebp + 0x4d4]
call fcn.004c80f0
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
cmp edi, 1
jle 0x4ca985
push str._remove
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
je 0x4ca6a0
push str._uninstall
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4ca736
call fcn.004c9160
mov ecx, 0x620704
call fcn.004c8fc0
mov ecx, str.Mesh_Agent
call fcn.004c8fc0
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x4ca6c7
push str.Failed_to_uninstall_mesh_agent
jmp 0x4ca6dd
cmp eax, 1
jne 0x4ca6d3
push str.Mesh_agent_uninstalled
jmp 0x4ca6dd
cmp eax, 2
jne 0x4ca6e5
push str.Mesh_agent_still_running
call fcn.004010e0
add esp, 4
push 0x620f20
push reloc.WS2_32.dll_bind
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call esi
push 0x620f40
push reloc.WS2_32.dll_accept
call esi
push 0x104
lea eax, [ebp + 0x4d4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 5
jbe 0x4cae43
lea ecx, [ebp + 0x4d4]
call fcn.004c84e0
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
cmp edi, 1
jle 0x4ca985
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
cmp eax, dword [str._update:]
jne 0x4ca799
mov eax, dword [ecx + 4]
cmp eax, dword [0x620f64]
jne 0x4ca799
lea eax, [ecx + 8]
push 0
push eax
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
call edi
test eax, eax
jne 0x4ca789
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call ebx
mov eax, dword [esi + 4]
add eax, 8
push 0
push eax
push dword [esi]
call edi
test eax, eax
je 0x4ca771
call fcn.004c90d0
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
cmp edi, 1
jle 0x4ca985
push str._netinfo
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4ca7dc
lea ecx, [ebp - 0x2c]
call fcn.0040b830
test eax, eax
jle 0x4cae43
push dword [ebp - 0x2c]
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
cmp edi, 1
jle 0x4ca985
push 0x620f78
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4ca85c
test ebx, ebx
jne 0x4ca801
xor esi, esi
jmp 0x4ca811
push 0x104
push ebx
call fcn.0058cca6
add esp, 8
mov esi, eax
mov edi, dword [ebp - 0x2c]
test edi, edi
jne 0x4ca834
xor eax, eax
push esi
push ebx
push eax
mov edx, edi
xor ecx, ecx
call fcn.004c92c0
add esp, 0xc
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
push 0x104
push edi
call fcn.0058cca6
add esp, 8
push esi
push ebx
push eax
mov edx, edi
xor ecx, ecx
call fcn.004c92c0
add esp, 0xc
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
cmp edi, 1
jle 0x4ca985
push 0x620f88
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4ca894
push eax
push eax
push eax
xor edx, edx
lea ecx, [eax + 1]
call fcn.004c92c0
add esp, 0xc
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
cmp edi, 1
jle 0x4ca985
push str._setfirewall
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4ca914
push 0x104
lea eax, [ebp + 0x4d4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.004c8720
test eax, eax
jne 0x4ca8e6
push 0x620fa8
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
lea ecx, [ebp + 0x4d4]
call fcn.004c84e0
lea ecx, [ebp + 0x4d4]
call fcn.004c80f0
push 0x620fc4
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
cmp edi, 1
jle 0x4ca985
push str._clearfirewall
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4ca985
push 0x104
lea eax, [ebp + 0x4d4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.004c8720
test eax, eax
jne 0x4ca962
push str.Must_run_as_administrator
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
lea ecx, [ebp + 0x4d4]
call fcn.004c84e0
push str.Done
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
cmp edi, 2
jne 0x4cad38
push str._nodeidhex
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4caa86
mov dword [ebp - 0x20], eax
xor esi, esi
lea eax, [ebp - 0x24]
push eax
push 0x201
push esi
push 0x62100c
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4caa62
lea eax, [ebp - 0x20]
push eax
push esi
push esi
push esi
push 0x62102c
push dword [ebp - 0x24]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call edi
test eax, eax
jne 0x4caa59
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4caa59
push eax
call fcn.0058d200
add esp, 4
mov esi, eax
test esi, esi
jne 0x4caa2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c1
mov edx, 0x621034
xor ecx, ecx
call fcn.004b47e0
push 0x4c1
push 0x621044
push 0x621054
jmp 0x4ca1cd
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push 0x621078
push dword [ebp - 0x24]
call edi
test eax, eax
jne 0x4caa4b
cmp dword [ebp - 0x20], eax
jne 0x4caa59
push esi
call fcn.0058bf82
add esp, 4
xor esi, esi
mov dword [ebp - 0x20], esi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4caa74
push esi
call fcn.004010e0
add esp, 4
jmp 0x4c9fd0
push str.Not_defined__start_the_mesh_service_to_create_a_nodeid.
call fcn.004010e0
add esp, 4
jmp 0x4c9fd0
cmp edi, 2
jne 0x4cad38
push str._info
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4cacac
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push 0x201
push 0
push 0x6210c0
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4c9fd0
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x6257a0
push 0
push 0
push str.NodeId
push dword [ebp - 0x20]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call esi
test eax, eax
je 0x4cab0b
mov dword [ebp - 0x1c], 0
push str.NodeId:_____none_
call fcn.004010e0
add esp, 4
jmp 0x4cab32
cmp dword [ebp - 0x1c], 0
jne 0x4cab20
push str.NodeId:_____none_
call fcn.004010e0
add esp, 4
jmp 0x4cab32
push 0x6257a0
push str.NodeId:_____s
call fcn.004010e0
add esp, 8
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x6257a0
push 0
push 0
push str.MeshId
push dword [ebp - 0x20]
call esi
test eax, eax
jne 0x4cab6b
cmp dword [ebp - 0x1c], eax
jbe 0x4cab6b
push 0x6257a0
push str._r_nMeshId:_____s
call fcn.004010e0
add esp, 8
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x6257a0
push 0
push 0
push str.AgentHash
push dword [ebp - 0x20]
call esi
test eax, eax
jne 0x4caba4
cmp dword [ebp - 0x1c], eax
jbe 0x4caba4
push 0x6257a0
push str._r_nAgentHash:__s
call fcn.004010e0
add esp, 8
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x6257a0
push 0
push 0
push str.MeshServerId
push dword [ebp - 0x20]
call esi
test eax, eax
jne 0x4cabdd
cmp dword [ebp - 0x1c], eax
jbe 0x4cabdd
push 0x6257a0
push str._r_nServerId:___s
call fcn.004010e0
add esp, 8
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x6257a0
push 0
push 0
push str.MeshServerUrl
push dword [ebp - 0x20]
call esi
test eax, eax
jne 0x4cac16
cmp dword [ebp - 0x1c], eax
jbe 0x4cac16
push 0x6257a0
push str._r_nServerUrl:__s
call fcn.004010e0
add esp, 8
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x6257a0
push 0
push 0
push str.Proxy
push dword [ebp - 0x20]
call esi
test eax, eax
jne 0x4cac4f
cmp dword [ebp - 0x1c], eax
jbe 0x4cac4f
push 0x6257a0
push str._r_nProxy:______s
call fcn.004010e0
add esp, 8
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x6257a0
push 0
push 0
push 0x621198
push dword [ebp - 0x20]
call esi
test eax, eax
je 0x4cac86
mov dword [ebp - 0x1c], 0
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4c9fd0
cmp dword [ebp - 0x1c], 0
jbe 0x4cac9e
push 0x6257a0
push str._r_nTag:________s
call fcn.004010e0
add esp, 8
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4c9fd0
cmp edi, 2
jne 0x4cad38
push str._resetnodeid
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4cad38
lea eax, [ebp - 0x2c]
push eax
push 0x20206
push 0
push str.SoftwareOpen_SourceMeshAgent2
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cad26
mov dword [ebp - 0x28], 1
push 4
lea eax, [ebp - 0x28]
push eax
push 4
push 0
push str.ResetNodeId
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4cad18
push str.NodeID_will_be_reset_next_time_the_Mesh_Agent_service_is_started.
call fcn.004010e0
add esp, 4
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4c9fd0
push str.Error_writing_to_registry__try_running_as_administrator.
call fcn.004010e0
add esp, 4
jmp 0x4c9fd0
mov ecx, 0x620704
call fcn.004c8fc0
cmp edi, 1
jle 0x4cadf3
push 1
push 3
push 0x621268
or edx, 0xffffffff
mov ecx, dword [esi + 4]
call fcn.004b3b30
add esp, 0xc
test eax, eax
je 0x4caddb
push 1
push 0x4c9ea0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov dword [ebp - 4], 1
xor ecx, ecx
call fcn.004064d0
mov dword [0x6234f8], eax
mov dword [eax + 0x6f0], 1
push esi
mov edx, edi
call fcn.00407f10
add esp, 4
call fcn.004083c0
mov dword [0x6234f8], 0
mov dword [ebp - 4], 0xfffffffe
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
push str.Mesh_Agent_available_switches:_r_n__run_______________Start_as_a_console_agent._r_n__connect___________Start_as_a_temporary_console_agent._r_n__start_____________Start_the_service._r_n__restart___________Restart_the_service._r_n__stop______________Stop_the_service._r_n__state_____________Display_the_running_state_of_the_service._r_n___signcheck________Perform_self_check._r_n___install__________Install_the_service_from_this_location._r_n___uninstall________Remove_the_service_from_this_location._r_n___nodeidhex________Return_the_current_agent_identifier._r_n___fullinstall______Copy_agent_into_program_files__install_and_launch._r_n___fulluninstall____Stop_agent_and_clean_up_the_program_files_location._r_n___proxy:host:port__Specifiy_an_HTTPS_proxy__after__fullinstall_only_._r_n___tag:xxx__________Specifiy_a_agent_tag___after__fullinstall_only_._r_n___resetnodeid______Reset_the_NodeID_next_time_the_service_is_started.
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
mov dword [ebp - 0x38], str.Mesh_Agent_background_service
mov dword [ebp - 0x34], 0x4c8c80
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x4cae43
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x427
jne 0x4cae43
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0
push 0x4cb5a0
push 0
push 0x67
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4c9fd0
push 1
push 0x4c9ea0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov dword [ebp - 4], 0
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
cmp edi, 1
jle 0x4cae89
push 0x620cd0
push dword [esi + 4]
call fcn.005941fc
add esp, 8
mov ecx, 0x20
test eax, eax
cmove ebx, ecx
mov dword [ebp - 0x3c], ebx
mov ecx, ebx
call fcn.004064d0
mov dword [0x6234f8], eax
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp - 0x24]
mov dword [eax + 0x10], edx
test ecx, ecx
jne 0x4caed7
cmp edi, 1
jle 0x4caee1
push 0x620cd8
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
je 0x4caed2
push str.connect
push dword [esi + 4]
call fcn.005941fc
add esp, 8
test eax, eax
jne 0x4caee1
mov eax, dword [0x6234f8]
mov dword [eax + 0x6f0], 1
push esi
mov edx, edi
call fcn.00407f10
add esp, 4
mov eax, dword [0x6234f8]
mov esi, dword [eax + 0x6e8]
mov dword [ebp - 0x40], esi
call fcn.004083c0
mov dword [0x6234f8], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4c9fd2