Function at 0x14008d87c
Capabilities:
Copy file
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x870
mov rax, qword [0x14021c510]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov rdi, rdx
mov esi, ecx
xor ebx, ebx
mov r12d, ebx
mov r15d, ebx
lea r13d, [rbx + 1]
cmp ecx, r13d
jle 0x14008d909
lea rdx, str._info
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008d909
lea r8, str.Feb_22_2019
lea rdx, str.17:19:00
lea rcx, str.Compiled_on:__s___s_n
call fcn.140001090
xor ecx, ecx
call fcn.1400b0770
mov rdx, rax
lea rcx, str.Using__s_n
call fcn.140001090
xor eax, eax
jmp 0x14008e745
cmp esi, 2
jle 0x14008d99f
lea rdx, str._faddr
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008d95e
mov qword [rsp + 0x38], rbx
mov rcx, qword [rdi + 0x10]
add rcx, 2
lea r8, [rsp + 0x38]
lea rdx, str._016llx
call fcn.140007b98
mov r8, qword [rsp + 0x38]
call fcn.140073a60
lea rdx, [0x140220180]
lea rcx, [0x1401e2314]
jmp 0x14008d8fd
cmp esi, 2
jle 0x14008d99f
lea rdx, str._fdelta
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008d99f
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x38]
lea rdx, str._lld
mov rcx, qword [rdi + 0x10]
call fcn.140007b98
lea r8, [0x1400736fc]
sub r8, qword [rsp + 0x38]
jmp 0x14008d949
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140066250
cmp esi, 2
jle 0x14008d9fc
lea rdx, str._exec
mov rcx, qword [rdi + 8]
call fcn.1401792d0
test eax, eax
jne 0x14008d9fc
cmp dword [rsp + 0x30], ebx
jne 0x14008d9fc
or edx, 0xffffffff
mov rcx, qword [rdi + 0x10]
call fcn.140078528
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14008d9e9
mov dword [rsp + 0x30], ebx
jmp 0x14008d9fc
mov edx, 0x1000
mov rcx, qword [rsp + 0x38]
call fcn.14017015c
mov dword [rsp + 0x30], eax
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rsp + 0x40], ebx
test esi, esi
jle 0x14008daa2
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rdi + rax*8]
test rcx, rcx
je 0x14008da8f
mov edx, 0x103
call fcn.14017015c
mov r8, rax
cmp rax, 7
jbe 0x14008da67
movsxd rcx, dword [rsp + 0x40]
mov rdx, qword [rdi + rcx*8]
mov ecx, dword [rdx]
cmp ecx, dword [str._proxy:]
jne 0x14008da67
movzx ecx, word [rdx + 4]
cmp cx, word [0x1401ff86c]
jne 0x14008da67
mov al, byte [rdx + 6]
cmp al, byte [0x1401ff86e]
jne 0x14008da67
lea r12, [rdx + 7]
jmp 0x14008da8f
cmp r8, 5
jb 0x14008da8f
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rdi + rax*8]
mov eax, dword [rcx]
cmp eax, dword [str._tag:]
jne 0x14008da8f
mov al, byte [rcx + 4]
cmp al, byte [0x1401ff874]
jne 0x14008da8f
lea r15, [rcx + 5]
mov eax, dword [rsp + 0x40]
add eax, r13d
mov dword [rsp + 0x40], eax
cmp eax, esi
jl 0x14008da15
cmp esi, r13d
jle 0x14008db1e
lea rdx, str._kvm0
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008dae5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 0x18]
call fcn.140073214
lea rcx, [0x14008d804]
mov qword [rax], rcx
mov dword [rax + 0x10], ebx
mov rcx, rax
call fcn.140008ecc
jmp 0x14008d902
cmp esi, r13d
jle 0x14008db1e
lea rdx, str._kvm1
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008db1e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 0x18]
call fcn.140073214
lea rcx, [0x14008d804]
mov qword [rax], rcx
mov dword [rax + 0x10], r13d
jmp 0x14008dad8
cmp qword [rsp + 0x38], rbx
jne 0x14008e673
test esi, esi
jle 0x14008db44
lea rdx, str.__slave
mov rcx, qword [rdi]
call fcn.140178bd4
test eax, eax
je 0x14008e673
cmp esi, r13d
jle 0x14008dcaf
lea rdx, [0x1401e2eb8]
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
je 0x14008e673
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
je 0x14008e673
lea rdx, str.__slave
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
je 0x14008e673
cmp esi, r13d
jle 0x14008dcaf
lea rdx, str.state
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008dc37
call fcn.14008c9d4
mov ebx, eax
cmp eax, r13d
jne 0x14008dbcb
lea rcx, str.Stopped
jmp 0x14008dc2b
cmp ebx, 2
jne 0x14008dbd9
lea rcx, str.Start_Pending
jmp 0x14008dc2b
cmp ebx, 3
jne 0x14008dbe7
lea rcx, str.Stop_Pending
jmp 0x14008dc2b
cmp ebx, 4
jne 0x14008dbf5
lea rcx, str.Running
jmp 0x14008dc2b
cmp ebx, 5
jne 0x14008dc03
lea rcx, str.Continue_Pending
jmp 0x14008dc2b
cmp ebx, 6
jne 0x14008dc11
lea rcx, str.Pause_Pending
jmp 0x14008dc2b
cmp ebx, 7
jne 0x14008dc1f
lea rcx, str.Paused
jmp 0x14008dc2b
cmp ebx, 0x64
jne 0x14008dc30
lea rcx, str.Not_installed
call fcn.140001090
mov eax, ebx
jmp 0x14008e745
cmp esi, r13d
jle 0x14008dcaf
lea rdx, str._signcheck
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008dcaf
mov r14d, 0x104
mov r8d, r14d
lea rdx, [rsp + 0x750]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 5
jbe 0x14008dcb5
call fcn.1400718a4
lea rcx, [rsp + 0x750]
call fcn.14000afa4
mov edx, eax
lea rcx, [0x1401ea5cc]
call fcn.140001090
mov eax, dword [0x14021fe78]
sub eax, r13d
mov dword [0x14021fe78], eax
test eax, eax
jg 0x14008d902
call fcn.1400aa000
jmp 0x14008d902
mov r14d, 0x104
cmp esi, r13d
jle 0x14008e10e
lea rdx, str.start
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
je 0x14008dce6
lea rdx, str._start
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008dd21
call fcn.14008ca78
test eax, eax
jne 0x14008dcfb
lea rcx, str.Failed_to_start_mesh_agent
jmp 0x14008e602
cmp eax, r13d
jne 0x14008dd0c
lea rcx, str.Started_the_mesh_agent
jmp 0x14008e602
cmp eax, 2
jne 0x14008e668
lea rcx, str.Mesh_agent_already_running
jmp 0x14008e602
cmp esi, r13d
jle 0x14008e10e
lea rdx, str.stop
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
je 0x14008dd52
lea rdx, str._stop
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008dd74
call fcn.14008cb34
cmp eax, r13d
jne 0x14008dd68
lea rcx, str.Stopped_mesh_agent
jmp 0x14008e602
lea rcx, str.Failed_to_stop_mesh_agent
jmp 0x14008e602
cmp esi, r13d
jle 0x14008e10e
lea rdx, str.restart
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
je 0x14008dda5
lea rdx, str._restart
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008dde5
call fcn.14008cb34
call fcn.14008ca78
test eax, eax
jne 0x14008ddbf
lea rcx, str.Failed_to_restart_mesh_agent
jmp 0x14008e602
cmp eax, r13d
jne 0x14008ddd0
lea rcx, str.Restarted_the_mesh_agent
jmp 0x14008e602
cmp eax, 2
jne 0x14008e668
lea rcx, str.Mesh_agent_failed_to_stop
jmp 0x14008e602
cmp esi, r13d
jle 0x14008e10e
lea rdx, str._install
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008de77
call fcn.14008cb34
lea rcx, str.Mesh_Agent
call fcn.14008c91c
lea rcx, [0x1401ff3f8]
call fcn.14008c91c
call fcn.14008c790
cmp eax, r13d
lea rcx, str.Mesh_agent_installed
je 0x14008de37
lea rcx, str.Failed_to_install_mesh_agent
call fcn.140001090
mov r8d, r14d
lea rdx, [rsp + 0x540]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 5
jbe 0x14008e668
lea rcx, [rsp + 0x540]
call fcn.14008bd7c
lea rcx, [rsp + 0x540]
call fcn.14008b8f0
jmp 0x14008e668
cmp esi, r13d
jle 0x14008e10e
lea rdx, str._remove
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
je 0x14008deac
lea rdx, str._uninstall
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008df4f
call fcn.14008cb34
lea rcx, [0x1401ff3f8]
call fcn.14008c91c
lea rcx, str.Mesh_Agent
call fcn.14008c91c
mov dword [rsp + 0x40], eax
test eax, eax
jne 0x14008deda
lea rcx, str.Failed_to_uninstall_mesh_agent
jmp 0x14008def4
cmp eax, r13d
jne 0x14008dee8
lea rcx, str.Mesh_agent_uninstalled
jmp 0x14008def4
cmp eax, 2
jne 0x14008def9
lea rcx, str.Mesh_agent_still_running
call fcn.140001090
lea rdx, [0x1401e2c88]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea rdx, [0x1401e2c88]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov r8d, r14d
lea rdx, [rsp + 0x540]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 5
jbe 0x14008e668
lea rcx, [rsp + 0x540]
call fcn.14008bd7c
jmp 0x14008e668
cmp esi, r13d
jle 0x14008e10e
mov rdx, qword [rdi + 8]
mov rax, qword [rdx]
cmp rax, qword [str._update:]
jne 0x14008df97
jmp 0x14008df79
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rdi + 8]
xor r8d, r8d
add rdx, 8
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x14008df6a
call fcn.14008ca78
jmp 0x14008e668
cmp esi, r13d
jle 0x14008e10e
lea rdx, str._netinfo
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008dfd0
lea rcx, [rsp + 0x38]
call fcn.14000ac9c
test eax, eax
jle 0x14008e668
mov rcx, qword [rsp + 0x38]
jmp 0x14008e602
cmp esi, r13d
jle 0x14008e10e
lea rdx, str._fullinstall
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008e029
test r15, r15
jne 0x14008dff7
mov rdi, rbx
jmp 0x14008e005
mov rdx, r14
mov rcx, r15
call fcn.14017015c
mov rdi, rax
test r12, r12
je 0x14008e018
mov rdx, r14
mov rcx, r12
call fcn.14017015c
mov rbx, rax
mov dword [rsp + 0x20], edi
mov r9, r15
mov r8d, ebx
mov rdx, r12
xor ecx, ecx
jmp 0x14008e055
cmp esi, r13d
jle 0x14008e10e
lea rdx, str._fulluninstall
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008e05f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r13d
call fcn.14008cce4
jmp 0x14008e668
cmp esi, r13d
jle 0x14008e10e
lea rdx, str._setfirewall
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008e0c0
mov r8d, r14d
lea rdx, [rsp + 0x540]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.14008c000
test eax, eax
jne 0x14008e0a4
lea rcx, str.Must_run_as_administrator
jmp 0x14008e602
lea rcx, [rsp + 0x540]
call fcn.14008bd7c
lea rcx, [rsp + 0x540]
call fcn.14008b8f0
jmp 0x14008e102
cmp esi, r13d
jle 0x14008e10e
lea rdx, str._clearfirewall
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008e10e
mov r8d, r14d
lea rdx, [rsp + 0x540]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.14008c000
test eax, eax
je 0x14008e098
lea rcx, [rsp + 0x540]
call fcn.14008bd7c
lea rcx, str.Done
jmp 0x14008e602
cmp esi, 2
jne 0x14008e57f
lea rdx, str._nodeidhex
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008e256
mov dword [rsp + 0x30], ebx
mov rdi, rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, r13d
xor r8d, r8d
lea rdx, [0x1401e2c88]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14008e23d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.NodeId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14008e232
cmp dword [rsp + 0x30], ebx
jbe 0x14008e232
mov ecx, dword [rsp + 0x30]
call fcn.1401707f0
mov rdi, rax
test rax, rax
jne 0x14008e1f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov edi, 0xfe
mov r9d, edi
mov ebx, 0x4bf
mov r8d, ebx
lea rdx, str.ServiceMain.c
xor ecx, ecx
call fcn.140078e6c
mov r8d, ebx
lea rdx, str.ServiceMain.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.140001090
mov ecx, edi
call fcn.14016a768
int3
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.NodeId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14008e223
cmp dword [rsp + 0x30], ebx
jne 0x14008e232
mov rcx, rdi
call fcn.14016f3a8
mov rdi, rbx
mov dword [rsp + 0x30], ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rdi, rdi
mov rcx, rdi
jne 0x14008e24c
lea rcx, str.Not_defined__start_the_mesh_service_to_create_a_nodeid.
call fcn.140001090
jmp 0x14008d902
cmp esi, 2
jne 0x14008e57f
lea rdx, str._info
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008e4de
mov dword [rsp + 0x30], ebx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, r13d
xor r8d, r8d
lea rdx, [0x1401e2c88]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14008d902
mov esi, 0x10000
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdi, [0x140221180]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.NodeId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
jne 0x14008e2fd
lea rcx, str.NodeId:_____none_
call fcn.140001090
jmp 0x14008e30c
mov rdx, rdi
lea rcx, str.NodeId:_____s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MeshId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x14008e357
mov rdx, rdi
lea rcx, str._r_nMeshId:_____s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.AgentHash
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x14008e3a2
mov rdx, rdi
lea rcx, str._r_nAgentHash:__s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MeshServerId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x14008e3ed
mov rdx, rdi
lea rcx, str._r_nServerId:___s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MeshServerUrl
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x14008e438
mov rdx, rdi
lea rcx, str._r_nServerUrl:__s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Proxy
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x14008e483
mov rdx, rdi
lea rcx, str._r_nProxy:______s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401e231c]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x14008e4ce
mov rdx, rdi
lea rcx, str._r_nTag:________s
call fcn.140001090
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14008d902
cmp esi, 2
jne 0x14008e57f
lea rdx, str._resetnodeid
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008e57f
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, [0x1401e2c88]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14008e573
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 2]
xor r8d, r8d
lea rdx, str.ResetNodeId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14008e4ce
lea rcx, str.NodeID_will_be_reset_next_time_the_Mesh_Agent_service_is_started.
call fcn.140001090
jmp 0x14008e4ce
lea rcx, str.Error_writing_to_registry__try_running_as_administrator.
jmp 0x14008e24c
lea rcx, [0x1401ff3f8]
call fcn.14008c91c
cmp esi, r13d
jle 0x14008e609
mov dword [rsp + 0x20], r13d
mov r9d, 3
lea r8, [0x1401e310c]
or edx, 0xffffffff
mov rcx, qword [rdi + 8]
call fcn.140078170
test eax, eax
je 0x14008e5fb
mov edx, r13d
lea rcx, [0x14008d848]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop
xor ecx, ecx
call fcn.140005818
mov qword [0x14021fec0], rax
mov dword [rax + 0x75c], r13d
mov r8, rdi
mov edx, esi
call fcn.140007294
call fcn.1400076f8
mov qword [0x14021fec0], rbx
jmp 0x14008e668
lea rcx, str.Mesh_Agent_available_switches:_r_n__run_______________Start_as_a_console_agent._r_n__connect___________Start_as_a_temporary_console_agent._r_n__start_____________Start_the_service._r_n__restart___________Restart_the_service._r_n__stop______________Stop_the_service._r_n__state_____________Display_the_running_state_of_the_service._r_n___signcheck________Perform_self_check._r_n___install__________Install_the_service_from_this_location._r_n___uninstall________Remove_the_service_from_this_location._r_n___nodeidhex________Return_the_current_agent_identifier._r_n___fullinstall______Copy_agent_into_program_files__install_and_launch._r_n___fulluninstall____Stop_agent_and_clean_up_the_program_files_location._r_n___proxy:host:port__Specifiy_an_HTTPS_proxy__after__fullinstall_only_._r_n___tag:xxx__________Specifiy_a_agent_tag___after__fullinstall_only_._r_n___resetnodeid______Reset_the_NodeID_next_time_the_service_is_started.
call fcn.140001090
jmp 0x14008e668
lea rax, str.Mesh_Agent_background_service
mov qword [rsp + 0x50], rax
lea rax, [0x14008c5d0]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
lea rcx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x14008e668
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x427
jne 0x14008e668
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov qword [rsp + 0x20], rbx
lea r9, [0x14008ece0]
xor r8d, r8d
lea edx, [r8 + 0x67]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DialogBoxParamA]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x14008d902
mov edx, r13d
lea rcx, [0x14008d848]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop
mov r14d, ebx
mov dword [rsp + 0x44], ebx
cmp esi, r13d
jle 0x14008e6b0
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.140178bd4
mov ecx, 0x20
test eax, eax
cmove r14d, ecx
mov dword [rsp + 0x44], r14d
mov ecx, r14d
call fcn.140005818
mov qword [0x14021fec0], rax
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0x20], rdx
mov ecx, dword [rsp + 0x30]
mov dword [rax + 0x28], ecx
test rdx, rdx
jne 0x14008e708
cmp esi, r13d
jle 0x14008e70f
lea rdx, [0x1401e2eb8]
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
je 0x14008e701
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.140178bd4
test eax, eax
jne 0x14008e70f
mov rax, qword [0x14021fec0]
mov dword [rax + 0x75c], r13d
mov r8, rdi
mov edx, esi
call fcn.140007294
mov rax, qword [0x14021fec0]
mov edi, dword [rax + 0x754]
mov dword [rsp + 0x48], edi
call fcn.1400076f8
mov qword [0x14021fec0], rbx
mov eax, edi
jmp 0x14008e745
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.140168070
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret