Function at 0x484970
Capabilities:
Copy file
Delete registry key
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x770]
sub esp, 0x770
push 0xfffffffffffffffe
push 0x6a9ce0
push 0x59e7f0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x6b0d44]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x76c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 0x778]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0x77c]
mov dword [ebp - 0x24], ecx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x44], ebx
push ebx
push ebx
lea esi, [eax*4 + 4]
lea eax, [eax*4 + 0x14]
push eax
call fcn.005d0f60
pop ecx
mov edx, esi
mov ecx, eax
call fcn.0046bf0b
pop ecx
pop ecx
mov edi, eax
mov dword [ebp - 0x34], edi
mov esi, dword [ebp - 0x1c]
test esi, esi
jle 0x484a5d
mov edi, dword [ebp - 0x24]
sub eax, edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esi
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [edi]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
push ebx
push ebx
lea ecx, [esi + 0x10]
push ecx
call fcn.005d0f60
pop ecx
mov edx, esi
mov ecx, eax
call fcn.0046bf0b
pop ecx
pop ecx
mov ecx, dword [ebp - 0x20]
mov dword [ecx + edi], eax
push ebx
push ebx
push esi
push eax
push 0xffffffffffffffff
push dword [edi]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edi, [edi + 4]
sub dword [ebp - 0x24], 1
jne 0x484a07
mov edi, dword [ebp - 0x34]
mov esi, dword [ebp - 0x1c]
cmp esi, 1
jle 0x484d83
push str._finstall
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
je 0x484a9f
push str._funinstall
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
je 0x484a9f
push 0x766a08
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x484ad1
mov eax, dword [edi + 4]
mov dword [edi + esi*4], eax
push ebx
push ebx
push 0x14
call fcn.005d0f60
pop ecx
push 4
pop edx
mov ecx, eax
call fcn.0046bf0b
mov dword [edi + 4], eax
push 0x766a18
push dword [eax - 0x10]
push eax
call fcn.0040112a
add esp, 0x14
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 1
jle 0x484d83
push str._licenses
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x484d00
push 0x766a28
call fcn.004010b4
mov dword [esp], str._MeshCentral_MeshAgent:_Copyright_2006___2020_Intel_Corporation_n
call fcn.004010b4
mov dword [esp], str.________________________https:__github.com_Ylianst_MeshAgent__n
call fcn.004010b4
mov dword [esp], 0x766b88
call fcn.004010b4
mov dword [esp], str.___Licensed_under_the_Apache_License__Version_2.0__the__License____n
call fcn.004010b4
mov dword [esp], str.___you_may_not_use_this_file_except_in_compliance_with_the_License._n
call fcn.004010b4
mov dword [esp], str.___You_may_obtain_a_copy_of_the_License_at_n
call fcn.004010b4
mov dword [esp], 0x766cc8
call fcn.004010b4
mov dword [esp], str.___http:__www.apache.org_licenses_LICENSE_2.0_n
call fcn.004010b4
mov dword [esp], 0x766cd0
call fcn.004010b4
mov dword [esp], str.___Unless_required_by_applicable_law_or_agreed_to_in_writing__software_n
call fcn.004010b4
mov dword [esp], str.___distributed_under_the_License_is_distributed_on_an__AS_IS__BASIS__n
call fcn.004010b4
mov dword [esp], str.___WITHOUT_WARRANTIES_OR_CONDITIONS_OF_ANY_KIND__either_express_or_implied._n
call fcn.004010b4
mov dword [esp], str.___See_the_License_for_the_specific_language_governing_permissions_and_n
call fcn.004010b4
mov dword [esp], str.___limitations_under_the_License._n_n
call fcn.004010b4
mov dword [esp], 0x766e00
call fcn.004010b4
mov dword [esp], str._Duktape_Javascript_Engine:_Copyright__c__2013_2019_by_Duktape_authors__see_AUTHORS.rst__n
call fcn.004010b4
mov dword [esp], str.________________________https:__github.com_svaarala_duktape__n
call fcn.004010b4
mov dword [esp], str.________________________http:__opensource.org_licenses_MIT__n
call fcn.004010b4
mov dword [esp], str._________________________________________________________________________________________n
call fcn.004010b4
mov dword [esp], str.___Permission_is_hereby_granted__free_of_charge__to_any_person_obtaining_a_copy_n
call fcn.004010b4
mov dword [esp], str.___of_this_software_and_associated_documentation_files_the__Software____to_deal_n
call fcn.004010b4
mov dword [esp], str.___in_the_Software_without_restriction__including_without_limitation_the_rights_n
call fcn.004010b4
mov dword [esp], str.___to_use__copy__modify__merge__publish__distribute__sublicense__and___or_sell_n
call fcn.004010b4
mov dword [esp], str.___copies_of_the_Software__and_to_permit_persons_to_whom_the_Software_is_n
call fcn.004010b4
mov dword [esp], str.___furnished_to_do_so__subject_to_the_following_conditions_:_n
call fcn.004010b4
mov dword [esp], 0x7671fc
call fcn.004010b4
mov dword [esp], str.___The_above_copyright_notice_and_this_permission_notice_shall_be_included_in_n
call fcn.004010b4
mov dword [esp], str.___all_copies_or_substantial_portions_of_the_Software._n
call fcn.004010b4
mov dword [esp], str.____n
call fcn.004010b4
mov dword [esp], str.___THE_SOFTWARE_IS_PROVIDED__AS_IS___WITHOUT_WARRANTY_OF_ANY_KIND__EXPRESS_OR_n
call fcn.004010b4
mov dword [esp], str.___IMPLIED__INCLUDING_BUT_NOT_LIMITED_TO_THE_WARRANTIES_OF_MERCHANTABILITY__n
call fcn.004010b4
mov dword [esp], str.___FITNESS_FOR_A_PARTICULAR_PURPOSE_AND_NONINFRINGEMENT.IN_NO_EVENT_SHALL_THE_n
call fcn.004010b4
mov dword [esp], str.___AUTHORS_OR_COPYRIGHT_HOLDERS_BE_LIABLE_FOR_ANY_CLAIM__DAMAGES_OR_OTHER_n
call fcn.004010b4
mov dword [esp], str.___LIABILITY__WHETHER_IN_AN_ACTION_OF_CONTRACT__TORT_OR_OTHERWISE__ARISING_FROM__n
call fcn.004010b4
mov dword [esp], str.___OUT_OF_OR_IN_CONNECTION_WITH_THE_SOFTWARE_OR_THE_USE_OR_OTHER_DEALINGS_IN_n
call fcn.004010b4
mov dword [esp], str.___THE_SOFTWARE._n
call fcn.004010b4
mov dword [esp], str._n
call fcn.004010b4
pop ecx
test dword [edi - 0x10], 0xfffffffc
jbe 0x484cd4
mov ecx, dword [edi + ebx*4]
call fcn.0046bfb6
inc ebx
mov eax, dword [edi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x484cc1
mov ecx, edi
call fcn.0046bfb6
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x76c]
xor ecx, ebp
call fcn.0059b3f0
lea esp, [ebp + 0x770]
pop ebp
ret
cmp esi, 1
jle 0x484d83
push 0x767074
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x484d83
push str.May__8_2020
push str.01:28:46
push str.Compiled_on:__s___s_n
call fcn.004010b4
push str.ae4df658cae965cce51c294749fd716fe57c7a5a
push str.___Commit_Hash:__s_n
call fcn.004010b4
push str.2020_May_8_01:18:21_0700
push str.___Commit_Date:__s_n
call fcn.004010b4
push ebx
call fcn.004a0d80
push eax
push str.Using__s_n
call fcn.004010b4
add esp, 0x28
test dword [edi - 0x10], 0xfffffffc
jbe 0x484cd4
mov ecx, dword [edi + ebx*4]
call fcn.0046bfb6
inc ebx
mov eax, dword [edi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x484d6b
jmp 0x484cd4
cmp esi, 2
jle 0x484e73
push str._faddr
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x484df7
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push 0x76720c
mov eax, dword [edi + 8]
add eax, 2
push eax
call fcn.0040869a
push ebx
push dword [ebp - 0x2c]
call fcn.0046c905
push 0x76c080
push 0x7673a4
call fcn.004010b4
add esp, 0x1c
test dword [edi - 0x10], 0xfffffffc
jbe 0x484cd4
mov ecx, dword [edi + ebx*4]
call fcn.0046bfb6
inc ebx
mov eax, dword [edi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x484ddf
jmp 0x484cd4
cmp esi, 2
jle 0x484e73
push str._fdelta
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x484e73
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
lea eax, [ebp - 0x38]
push eax
push str._lld
push dword [edi + 8]
call fcn.0040869a
mov ecx, 0x46c501
xor eax, eax
sub ecx, dword [ebp - 0x38]
sbb eax, dword [ebp - 0x34]
push eax
push ecx
call fcn.0046c905
push 0x76c080
push 0x767404
call fcn.004010b4
add esp, 0x1c
test dword [edi - 0x10], 0xfffffffc
jbe 0x484cd4
mov ecx, dword [edi + ebx*4]
call fcn.0046bfb6
inc ebx
mov eax, dword [edi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x484e5b
jmp 0x484cd4
push 0x104
lea eax, [ebp + 0x428]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
lea ecx, [ebp + 0x428]
call fcn.0045f9f4
pop ecx
cmp esi, 2
jle 0x484f04
mov ecx, str._exec
mov eax, dword [edi + 4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x484ec6
test dl, dl
je 0x484ec2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x484ec6
add eax, 2
add ecx, 2
test dl, dl
jne 0x484ea6
mov eax, ebx
jmp 0x484ecb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x484f04
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x20], edx
test edx, edx
jne 0x484f0a
or edx, 0xffffffff
mov ecx, dword [edi + 8]
call fcn.00470c3a
mov ecx, eax
mov dword [ebp - 0x24], ecx
test ecx, ecx
jne 0x484ef1
mov edx, ebx
jmp 0x484f07
push 0x1000
push dword [ebp - 0x24]
call fcn.005d06e0
pop ecx
pop ecx
mov edx, eax
jmp 0x484f07
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x20], edx
cmp esi, 2
jle 0x484f7c
mov ecx, str._b64exec
mov eax, dword [edi + 4]
mov dl, byte [eax]
mov byte [ebp - 0x25], dl
cmp dl, byte [ecx]
mov edx, dword [ebp - 0x20]
jne 0x484f45
cmp byte [ebp - 0x25], bl
je 0x484f41
mov dl, byte [eax + 1]
mov byte [ebp - 0x25], dl
cmp dl, byte [ecx + 1]
mov edx, dword [ebp - 0x20]
jne 0x484f45
add eax, 2
add ecx, 2
cmp byte [ebp - 0x25], bl
jne 0x484f17
mov eax, ebx
jmp 0x484f4a
sbb eax, eax
or eax, 1
test eax, eax
jne 0x484f7c
test edx, edx
jne 0x484f7c
cmp dword [edi + 8], ebx
jne 0x484f5b
mov eax, ebx
jmp 0x484f6a
push 0x10000
push dword [edi + 8]
call fcn.005d06e0
pop ecx
pop ecx
lea ecx, [ebp - 0x24]
push ecx
mov edx, eax
mov ecx, dword [edi + 8]
call fcn.0046f721
pop ecx
mov dword [ebp - 0x20], eax
cmp esi, 1
jle 0x484fc3
push str._nodeid
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x484fc3
push 0xd
pop ecx
mov esi, str.console.log_require__agentNodeId_____process.exit___
lea edi, [ebp + 0x734]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x36
pop eax
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x734]
call fcn.00470c3a
mov dword [ebp - 0x24], eax
mov edi, dword [ebp - 0x34]
mov esi, dword [ebp - 0x1c]
push 2
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0x30], ebx
test esi, esi
jle 0x485058
mov eax, dword [ebp - 0x30]
cmp dword [edi + eax*4], 0
je 0x48504b
push 0x103
push dword [edi + eax*4]
call fcn.005d06e0
pop ecx
pop ecx
mov edx, eax
cmp edx, 7
jbe 0x485026
mov ecx, dword [ebp - 0x30]
mov ecx, dword [edi + ecx*4]
mov eax, dword [ecx]
cmp eax, dword [str._proxy:]
mov ebx, str._proxy:
jne 0x485026
movzx eax, word [ecx + 4]
cmp ax, word [ebx + 4]
jne 0x485026
movzx eax, byte [ecx + 6]
cmp al, byte [ebx + 6]
jne 0x485026
lea edx, [ecx + 7]
mov dword [ebp - 0x2c], edx
jmp 0x48504b
cmp edx, 5
jb 0x48504b
mov eax, dword [ebp - 0x30]
mov ecx, dword [edi + eax*4]
mov edx, str._tag:
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x48504b
movzx eax, byte [ecx + 4]
cmp al, byte [edx + 4]
jne 0x48504b
add ecx, 5
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, esi
jl 0x484fd7
xor ebx, ebx
cmp esi, 1
jle 0x485288
push str._kvm0
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x48516d
push ebx
push ebx
xor edx, edx
push 0x10
pop ecx
call fcn.0046c097
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov dword [eax], 0x484923
mov dword [eax + 8], ebx
cmp esi, 2
jle 0x4850af
push 0x767540
push dword [edi + 8]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x4850af
xor ecx, ecx
inc ecx
jmp 0x4850b1
mov ecx, ebx
mov eax, dword [ebp - 0x34]
mov dword [eax + 0xc], ecx
cmp esi, 2
jle 0x4850cf
push 0x76754c
push dword [edi + 8]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
je 0x4850e7
cmp esi, 3
jle 0x4850f1
push 0x76755c
push dword [edi + 0xc]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x4850f1
mov dword [0x76a42c], 1
push 0x800
push ebx
push 0x76756c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
mov eax, ebx
test esi, esi
je 0x485129
push 0x767578
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x48512d
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x48513a
push 2
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x485140
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
push dword [ebp - 0x34]
call fcn.00409d5c
test dword [edi - 0x10], 0xfffffffc
jbe 0x484cd4
mov ecx, dword [edi + ebx*4]
call fcn.0046bfb6
inc ebx
mov eax, dword [edi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x485155
jmp 0x484cd4
cmp esi, 1
jle 0x485288
push str._kvm1
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x485288
push ebx
push ebx
xor edx, edx
push 0x10
pop ecx
call fcn.0046c097
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov dword [eax], 0x484923
mov dword [eax + 8], 1
cmp esi, 2
jle 0x4851c8
push str._coredump
push dword [edi + 8]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x4851c8
xor ecx, ecx
inc ecx
jmp 0x4851ca
mov ecx, ebx
mov eax, dword [ebp - 0x34]
mov dword [eax + 0xc], ecx
cmp esi, 2
jle 0x4851e8
push 0x7675a4
push dword [edi + 8]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
je 0x485200
cmp esi, 3
jle 0x48520a
push str._remotecursor
push dword [edi + 0xc]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x48520a
mov dword [0x76a42c], 1
push 0x800
push ebx
push str.Shcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
mov eax, ebx
test esi, esi
je 0x485242
push str.SetProcessDpiAwareness
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x485246
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x485253
push 2
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x485259
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
push dword [ebp - 0x34]
call fcn.00409d5c
mov esi, ebx
test dword [edi - 0x10], 0xfffffffc
jbe 0x485eff
mov ecx, dword [edi + esi*4]
call fcn.0046bfb6
inc esi
mov eax, dword [edi - 0x10]
shr eax, 2
cmp esi, eax
jl 0x485270
jmp 0x485eff
cmp dword [ebp - 0x24], 0
jne 0x485e2e
test esi, esi
jle 0x4852ac
push 0x7675e8
push dword [edi]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
je 0x485e2e
cmp esi, 1
jle 0x485911
push 0x7675f0
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
je 0x485e2e
push 0x7675f4
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
je 0x485e2e
push str.__slave
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
je 0x485e2e
cmp esi, 1
jle 0x485911
push str.state
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x4853aa
call fcn.00483b4f
mov esi, eax
cmp esi, 1
jne 0x48532d
push 0x767620
jmp 0x48537f
cmp esi, 2
jne 0x485339
push 0x767628
jmp 0x48537f
cmp esi, 3
jne 0x485345
push 0x767638
jmp 0x48537f
cmp esi, 4
jne 0x485351
push 0x767648
jmp 0x48537f
cmp esi, 5
jne 0x48535d
push 0x767650
jmp 0x48537f
cmp esi, 6
jne 0x485369
push 0x767664
jmp 0x48537f
cmp esi, 7
jne 0x485375
push 0x767674
jmp 0x48537f
cmp esi, 0x64
jne 0x485385
push str.Not_installed
call fcn.004010b4
pop ecx
test dword [edi - 0x10], 0xfffffffc
jbe 0x485efd
mov ecx, dword [edi + ebx*4]
call fcn.0046bfb6
inc ebx
mov eax, dword [edi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x485392
jmp 0x485efd
cmp esi, 1
jle 0x485911
push str._signcheck
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x485427
push 0x104
lea eax, [ebp + 0x324]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 5
jbe 0x485427
call fcn.0046ab3b
lea ecx, [ebp + 0x324]
call fcn.0040ba8a
push eax
push 0x767698
call fcn.004010b4
pop ecx
pop ecx
call fcn.0046ac0d
mov esi, ebx
test dword [edi - 0x10], 0xfffffffc
jbe 0x485eff
mov ecx, dword [edi + esi*4]
call fcn.0046bfb6
inc esi
mov eax, dword [edi - 0x10]
shr eax, 2
cmp esi, eax
jl 0x48540f
jmp 0x485eff
cmp esi, 1
jle 0x485911
push str.start
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
je 0x485456
push str._start
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x48548b
call fcn.00483bbf
test eax, eax
jne 0x485469
push str.Failed_to_start_mesh_agent
jmp 0x485de5
cmp eax, 1
jne 0x485478
push str.Started_the_mesh_agent
jmp 0x485de5
cmp eax, 2
jne 0x485e03
push str.Mesh_agent_already_running
jmp 0x485de5
cmp esi, 1
jle 0x485911
push str.stop
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
je 0x4854ba
push str._stop
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x4854d8
call fcn.00483c42
cmp eax, 1
jne 0x4854ce
push str.Stopped_mesh_agent
jmp 0x485de5
push str.Failed_to_stop_mesh_agent
jmp 0x485de5
cmp esi, 1
jle 0x485911
push str.restart
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
je 0x485507
push str._restart
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x485541
call fcn.00483c42
call fcn.00483bbf
test eax, eax
jne 0x48551f
push str.Failed_to_restart_mesh_agent
jmp 0x485de5
cmp eax, 1
jne 0x48552e
push str.Restarted_the_mesh_agent
jmp 0x485de5
cmp eax, 2
jne 0x485e03
push str.Mesh_agent_failed_to_stop
jmp 0x485de5
cmp esi, 1
jle 0x485911
push str._install
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x48562c
call fcn.00483c42
mov ecx, str.Mesh_Agent
call fcn.004839e4
mov ecx, 0x765f50
call fcn.004839e4
call fcn.00483866
cmp eax, 1
jne 0x48558b
push str.Mesh_agent_installed
jmp 0x485590
push str.Failed_to_install_mesh_agent
call fcn.004010b4
pop ecx
push 0x104
lea eax, [ebp + 0x52c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 5
jbe 0x485e03
lea ecx, [ebp + 0x52c]
call fcn.00482f8e
lea ecx, [ebp + 0x52c]
call fcn.00482bb6
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4855ff
call esi
push eax
push ebx
push 0x511
mov edx, 0x7677ec
mov ecx, 0x7677fc
call fcn.0047145c
add esp, 0xc
call esi
push eax
push str.Firewall_rules_added_successfully
push 0x767844
jmp 0x485743
call esi
push eax
push ebx
push 0x517
mov edx, 0x767858
mov ecx, 0x767868
call fcn.0047145c
add esp, 0xc
call esi
push eax
push str.Unable_to_add_firewall_rules
push 0x7678a8
jmp 0x485743
cmp esi, 1
jle 0x485911
push str._remove
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
je 0x48565f
push str._uninstall
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x48574d
call fcn.00483c42
mov ecx, 0x765f50
call fcn.004839e4
mov ecx, str.Mesh_Agent
call fcn.004839e4
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x485686
push str.Failed_to_uninstall_mesh_agent
jmp 0x48569c
cmp eax, 1
jne 0x485692
push str.Mesh_agent_uninstalled
jmp 0x48569c
cmp eax, 2
jne 0x4856a2
push str.Mesh_agent_still_running
call fcn.004010b4
pop ecx
push 0x767924
push reloc.WS2_32.dll_bind
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call esi
push 0x767944
push reloc.WS2_32.dll_accept
call esi
push 0x104
lea eax, [ebp + 0x52c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 5
jbe 0x485e03
lea ecx, [ebp + 0x52c]
call fcn.00482f8e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x48571b
call esi
push eax
push ebx
push 0x534
mov edx, 0x767964
mov ecx, 0x767974
call fcn.0047145c
add esp, 0xc
call esi
push eax
push str.Firewall_rules_removed_successfully
push 0x7679bc
jmp 0x485743
call esi
push eax
push ebx
push 0x53a
mov edx, 0x7679d0
mov ecx, 0x7679e0
call fcn.0047145c
add esp, 0xc
call esi
push eax
push str.Unable_to_remove_firewall_rules
push str.ILIBMSG:__s___d_._r_n
call fcn.004010b4
jmp 0x485854
cmp esi, 1
jle 0x485911
mov ecx, dword [edi + 4]
mov edx, str._update:
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x48579c
mov eax, dword [ecx + 4]
cmp eax, dword [edx + 4]
jne 0x48579c
lea eax, [ecx + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x485788
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [edi + 4]
add eax, 8
push ebx
push eax
push dword [edi]
call esi
test eax, eax
je 0x485777
call fcn.00483bbf
jmp 0x485e03
cmp esi, 1
jle 0x485911
push str._netinfo
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x4857d0
lea ecx, [ebp - 0x34]
call fcn.0040b827
test eax, eax
jle 0x485e03
push dword [ebp - 0x34]
jmp 0x485de5
cmp esi, 1
jle 0x485911
push 0x767a4c
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x48582b
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x4857f7
mov esi, ebx
jmp 0x485806
push 0x104
push eax
call fcn.005d06e0
pop ecx
pop ecx
mov esi, eax
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x485811
mov eax, ebx
jmp 0x48581e
push 0x104
push eax
call fcn.005d06e0
pop ecx
pop ecx
push esi
mov ecx, dword [ebp - 0x44]
push ecx
push eax
mov edx, dword [ebp - 0x2c]
xor ecx, ecx
jmp 0x48584f
cmp esi, 1
jle 0x485911
push 0x767a5c
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x48585c
push ebx
push ebx
push ebx
xor edx, edx
xor ecx, ecx
inc ecx
call fcn.00483db0
add esp, 0xc
jmp 0x485e03
cmp esi, 1
jle 0x485911
push str._setfirewall
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x4858be
push 0x104
lea eax, [ebp + 0x52c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.004831ae
test eax, eax
jne 0x48589e
push 0x767a7c
jmp 0x485de5
lea ecx, [ebp + 0x52c]
call fcn.00482f8e
lea ecx, [ebp + 0x52c]
call fcn.00482bb6
push 0x767a98
jmp 0x485de5
cmp esi, 1
jle 0x485911
push str._clearfirewall
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x485911
push 0x104
lea eax, [ebp + 0x52c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.004831ae
test eax, eax
jne 0x4858fc
push str.Must_run_as_administrator
jmp 0x485de5
lea ecx, [ebp + 0x52c]
call fcn.00482f8e
push str.Done
jmp 0x485de5
cmp esi, 2
jne 0x485d0a
push str._nodeidhex
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x485a29
mov dword [ebp - 0x24], ebx
mov esi, ebx
lea eax, [ebp - 0x2c]
push eax
push 0x201
push ebx
push 0x767ae0
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4859f0
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push ebx
push 0x767b00
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4859e7
cmp dword [ebp - 0x24], eax
jbe 0x4859e7
push dword [ebp - 0x24]
call fcn.005d0f60
pop ecx
mov esi, eax
test esi, esi
jne 0x4859bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, 0xfe
push edi
mov esi, 0x57c
push esi
mov edx, 0x767b08
xor ecx, ecx
call fcn.0047145c
push esi
push 0x767b18
push 0x767b28
call fcn.004010b4
add esp, 0x18
push edi
call fcn.005aae60
lea eax, [ebp - 0x24]
push eax
push esi
push ebx
push ebx
push 0x767b4c
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4859db
cmp dword [ebp - 0x24], eax
jne 0x4859e7
push esi
call fcn.005d0f40
pop ecx
mov esi, ebx
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4859f7
push esi
jmp 0x4859fc
push str.Not_defined__start_the_mesh_service_to_create_a_nodeid.
call fcn.004010b4
pop ecx
mov esi, ebx
test dword [edi - 0x10], 0xfffffffc
jbe 0x485eff
mov ecx, dword [edi + esi*4]
call fcn.0046bfb6
inc esi
mov eax, dword [edi - 0x10]
shr eax, 2
cmp esi, eax
jl 0x485a11
jmp 0x485eff
cmp esi, 2
jne 0x485d0a
push str._info
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x485c62
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x20]
push eax
push 0x201
push ebx
push 0x767b94
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x485c3b
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x76d080
push ebx
push ebx
push str.NodeId
push dword [ebp - 0x20]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call esi
mov ecx, dword [ebp - 0x1c]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x1c], ecx
test ecx, ecx
jne 0x485aad
push str.NodeId:_____none_
call fcn.004010b4
jmp 0x485abd
push 0x76d080
push str.NodeId:_____s
call fcn.004010b4
pop ecx
pop ecx
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x76d080
push ebx
push ebx
push str.MeshId
push dword [ebp - 0x20]
call esi
mov ecx, dword [ebp - 0x1c]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x485afc
push 0x76d080
push str._r_nMeshId:_____s
call fcn.004010b4
pop ecx
pop ecx
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x76d080
push ebx
push ebx
push str.AgentHash
push dword [ebp - 0x20]
call esi
mov ecx, dword [ebp - 0x1c]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x485b3a
push 0x76d080
push str._r_nAgentHash:__s
call fcn.004010b4
pop ecx
pop ecx
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x76d080
push ebx
push ebx
push str.MeshServerId
push dword [ebp - 0x20]
call esi
mov ecx, dword [ebp - 0x1c]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x485b78
push 0x76d080
push str._r_nServerId:___s
call fcn.004010b4
pop ecx
pop ecx
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x76d080
push ebx
push ebx
push str.MeshServerUrl
push dword [ebp - 0x20]
call esi
mov ecx, dword [ebp - 0x1c]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x485bb6
push 0x76d080
push str._r_nServerUrl:__s
call fcn.004010b4
pop ecx
pop ecx
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x76d080
push ebx
push ebx
push str.Proxy
push dword [ebp - 0x20]
call esi
mov ecx, dword [ebp - 0x1c]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x485bf4
push 0x76d080
push str._r_nProxy:______s
call fcn.004010b4
pop ecx
pop ecx
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x76d080
push ebx
push ebx
push 0x767c6c
push dword [ebp - 0x20]
call esi
mov ecx, dword [ebp - 0x1c]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x485c32
push 0x76d080
push str._r_nTag:________s
call fcn.004010b4
pop ecx
pop ecx
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, ebx
test dword [edi - 0x10], 0xfffffffc
jbe 0x485eff
mov ecx, dword [edi + esi*4]
call fcn.0046bfb6
inc esi
mov eax, dword [edi - 0x10]
shr eax, 2
cmp esi, eax
jl 0x485c4a
jmp 0x485eff
cmp esi, 2
jne 0x485d0a
push str._resetnodeid
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x485d0a
lea eax, [ebp - 0x34]
push eax
push 0x20206
push ebx
push str.SoftwareOpen_SourceMeshAgent2
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x485cd8
mov dword [ebp - 0x30], 1
push 4
lea eax, [ebp - 0x30]
push eax
push 4
push ebx
push str.ResetNodeId
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x485ccd
push str.NodeID_will_be_reset_next_time_the_Mesh_Agent_service_is_started.
call fcn.004010b4
pop ecx
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x485ce3
push str.Error_writing_to_registry__try_running_as_administrator.
call fcn.004010b4
pop ecx
mov esi, ebx
test dword [edi - 0x10], 0xfffffffc
jbe 0x485eff
mov ecx, dword [edi + esi*4]
call fcn.0046bfb6
inc esi
mov eax, dword [edi - 0x10]
shr eax, 2
cmp esi, eax
jl 0x485cf2
jmp 0x485eff
mov ecx, 0x765f50
call fcn.004839e4
mov dword [ebp - 0x40], str.Mesh_Agent_background_service
mov dword [ebp - 0x3c], 0x4836dd
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [0x76ae24], esi
mov dword [0x76ae20], edi
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x485e03
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x427
jne 0x485e03
cmp esi, 2
jl 0x485ddb
push 1
push 3
push 0x767d3c
or edx, 0xffffffff
mov ecx, dword [edi + 4]
call fcn.00470951
add esp, 0xc
test eax, eax
je 0x485ddb
push 1
push 0x484949
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov dword [ebp - 4], 1
xor ecx, ecx
call fcn.004059d1
mov dword [0x76a5a4], eax
mov dword [eax + 0xb24], 1
push edi
mov edx, esi
call fcn.004076ba
pop ecx
call fcn.00407ae3
mov dword [0x76a5a4], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x485e03
cmp esi, 1
je 0x485ded
push str.Mesh_Agent_available_switches:_r_n__run_______________Start_as_a_console_agent._r_n__connect___________Start_as_a_temporary_console_agent._r_n__start_____________Start_the_service._r_n__restart___________Restart_the_service._r_n__stop______________Stop_the_service._r_n__state_____________Display_the_running_state_of_the_service._r_n___signcheck________Perform_self_check._r_n___install__________Install_the_service_from_this_location._r_n___uninstall________Remove_the_service_from_this_location._r_n___nodeidhex________Return_the_current_agent_identifier._r_n___fullinstall______Copy_agent_into_program_files__install_and_launch._r_n___fulluninstall____Stop_agent_and_clean_up_the_program_files_location._r_n___proxy:host:port__Specifiy_an_HTTPS_proxy__after__fullinstall_only_._r_n___tag:xxx__________Specifiy_a_agent_tag___after__fullinstall_only_._r_n___resetnodeid______Reset_the_NodeID_next_time_the_service_is_started.
call fcn.004010b4
pop ecx
jmp 0x485e03
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push ebx
push 0x48647e
push ebx
push 0x67
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
call dword [sym.imp.ole32.dll_CoUninitialize]
test dword [edi - 0x10], 0xfffffffc
jbe 0x484cd4
mov ecx, dword [edi + ebx*4]
call fcn.0046bfb6
inc ebx
mov eax, dword [edi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x485e16
jmp 0x484cd4
push 1
push 0x484949
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov dword [ebp - 4], ebx
mov ecx, ebx
mov dword [ebp - 0x48], ecx
cmp esi, 1
jle 0x485e64
push 0x767604
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
mov ecx, ebx
push 0x20
pop edx
test eax, eax
cmove ecx, edx
mov dword [ebp - 0x48], ecx
call fcn.004059d1
mov dword [0x76a5a4], eax
mov ecx, dword [ebp - 0x24]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 0x20]
mov dword [eax + 0x14], edx
test ecx, ecx
jne 0x485eae
cmp esi, 1
jle 0x485eb8
push 0x76760c
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
je 0x485ea9
push str.connect
push dword [edi + 4]
call fcn.005ec0e0
pop ecx
pop ecx
test eax, eax
jne 0x485eb8
mov eax, dword [0x76a5a4]
mov dword [eax + 0xb24], 1
push edi
mov edx, esi
call fcn.004076ba
pop ecx
mov eax, dword [0x76a5a4]
mov esi, dword [eax + 0xb14]
mov dword [ebp - 0x4c], esi
call fcn.00407ae3
mov dword [0x76a5a4], ebx
mov dword [ebp - 4], 0xfffffffe
test dword [edi - 0x10], 0xfffffffc
jbe 0x485efd
mov ecx, dword [edi + ebx*4]
call fcn.0046bfb6
inc ebx
mov eax, dword [edi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x485eea
mov ebx, esi
mov ecx, edi
call fcn.0046bfb6
mov eax, ebx
jmp 0x484cdd