Function at 0x140081a94
Capabilities:
Copy file
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x880
mov rax, qword [0x1401ff510]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov rsi, rdx
mov r14d, ecx
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov r13d, ebx
cmp ecx, 2
jle 0x140081b3f
mov rcx, qword [rdx + 8]
mov eax, dword [rcx]
cmp eax, dword [str._faddr]
jne 0x140081b3f
movzx eax, word [rcx + 4]
cmp ax, word [0x1401e3a10]
jne 0x140081b3f
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x140081b06
mov edx, 0x82
call fcn.140163e74
mov rbx, rax
lea edx, [rbx - 2]
mov rcx, qword [rsi + 0x10]
add rcx, 2
lea r8, [rsp + 0x38]
call fcn.140065fb4
mov r8, qword [rsp + 0x38]
call fcn.140068e1c
lea rdx, [0x140203120]
lea rcx, [0x1401d590c]
call fcn.140001090
xor eax, eax
jmp 0x1400828bd
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.14005aeb0
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rsp + 0x40], ebx
mov edi, 1
test r14d, r14d
jle 0x140081bff
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsi + rax*8]
test rcx, rcx
je 0x140081bec
mov edx, 0x103
call fcn.140163e74
mov r8, rax
cmp rax, 7
jbe 0x140081bc4
movsxd rcx, dword [rsp + 0x40]
mov rdx, qword [rsi + rcx*8]
mov ecx, dword [rdx]
cmp ecx, dword [str._proxy:]
jne 0x140081bc4
movzx ecx, word [rdx + 4]
cmp cx, word [0x1401e3a1c]
jne 0x140081bc4
mov al, byte [rdx + 6]
cmp al, byte [0x1401e3a1e]
jne 0x140081bc4
add rdx, 7
mov qword [rsp + 0x38], rdx
jmp 0x140081bec
cmp r8, 5
jb 0x140081bec
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsi + rax*8]
mov eax, dword [rcx]
cmp eax, dword [str._tag:]
jne 0x140081bec
mov al, byte [rcx + 4]
cmp al, byte [0x1401e3a24]
jne 0x140081bec
lea r13, [rcx + 5]
mov eax, dword [rsp + 0x40]
add eax, edi
mov dword [rsp + 0x40], eax
cmp eax, r14d
jl 0x140081b6d
cmp r14d, edi
jle 0x140081c7a
lea rdx, str._kvm0
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
jne 0x140081c42
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 0x18]
call fcn.1400686a4
lea rcx, [0x140081a1c]
mov qword [rax], rcx
mov dword [rax + 0x10], ebx
mov rcx, rax
call fcn.140007b34
jmp 0x140081b38
cmp r14d, edi
jle 0x140081c7a
lea rdx, str._kvm1
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
jne 0x140081c7a
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 0x18]
call fcn.1400686a4
lea rcx, [0x140081a1c]
mov qword [rax], rcx
mov dword [rax + 0x10], edi
jmp 0x140081c35
mov r12, qword [rsp + 0x48]
test r12, r12
jne 0x1400827f4
test r14d, r14d
jle 0x140081ca4
lea rdx, str.__slave
mov rcx, qword [rsi]
call fcn.14016c948
test eax, eax
je 0x1400827f4
cmp r14d, edi
jle 0x140081e0f
lea rdx, [0x1401d5df0]
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
je 0x1400827f4
lea rdx, str.connect
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
je 0x1400827f4
lea rdx, str.__slave
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
je 0x1400827f4
cmp r14d, edi
jle 0x140081e0f
lea rdx, str.state
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
jne 0x140081d98
call fcn.140080d48
mov ebx, eax
cmp eax, edi
jne 0x140081d2a
lea rcx, str.Stopped
jmp 0x140081d8e
cmp ebx, 2
jne 0x140081d38
lea rcx, str.Start_Pending
jmp 0x140081d8e
cmp ebx, 3
jne 0x140081d46
lea rcx, str.Stop_Pending
jmp 0x140081d8e
cmp ebx, 4
jne 0x140081d54
lea rcx, str.Running
jmp 0x140081d8e
cmp ebx, 5
jne 0x140081d62
lea rcx, str.Continue_Pending
jmp 0x140081d8e
cmp ebx, 6
jne 0x140081d70
lea rcx, str.Pause_Pending
jmp 0x140081d8e
cmp ebx, 7
jne 0x140081d7e
lea rcx, str.Paused
jmp 0x140081d8e
cmp ebx, 0x64
jne 0x1400828ab
lea rcx, str.Not_installed
call fcn.140001090
jmp 0x1400828ab
cmp r14d, edi
jle 0x140081e0f
lea rdx, str._signcheck
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
jne 0x140081e0f
mov r15d, 0x104
mov r8d, r15d
lea rdx, [rsp + 0x760]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 5
jbe 0x140081e15
call fcn.1400661a4
lea rcx, [rsp + 0x760]
call fcn.140009b94
mov edx, eax
lea rcx, [0x1401dc63c]
call fcn.140001090
mov eax, dword [0x140202e0c]
sub eax, edi
mov dword [0x140202e0c], eax
test eax, eax
jg 0x140081b38
call fcn.140099740
jmp 0x140081b38
mov r15d, 0x104
cmp r14d, edi
jle 0x14008226d
lea rdx, str.start
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
je 0x140081e46
lea rdx, str._start
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
jne 0x140081e80
call fcn.140080dec
test eax, eax
jne 0x140081e5b
lea rcx, str.Failed_to_start_mesh_agent
jmp 0x14008275d
cmp eax, edi
jne 0x140081e6b
lea rcx, str.Started_the_mesh_agent
jmp 0x14008275d
cmp eax, 2
jne 0x1400827e9
lea rcx, str.Mesh_agent_already_running
jmp 0x14008275d
cmp r14d, edi
jle 0x14008226d
lea rdx, str.stop
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
je 0x140081eb1
lea rdx, str._stop
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
jne 0x140081ed2
call fcn.140080ea8
cmp eax, edi
jne 0x140081ec6
lea rcx, str.Stopped_mesh_agent
jmp 0x14008275d
lea rcx, str.Failed_to_stop_mesh_agent
jmp 0x14008275d
cmp r14d, edi
jle 0x14008226d
lea rdx, str.restart
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
je 0x140081f03
lea rdx, str._restart
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
jne 0x140081f42
call fcn.140080ea8
call fcn.140080dec
test eax, eax
jne 0x140081f1d
lea rcx, str.Failed_to_restart_mesh_agent
jmp 0x14008275d
cmp eax, edi
jne 0x140081f2d
lea rcx, str.Restarted_the_mesh_agent
jmp 0x14008275d
cmp eax, 2
jne 0x1400827e9
lea rcx, str.Mesh_agent_failed_to_stop
jmp 0x14008275d
cmp r14d, edi
jle 0x14008226d
lea rdx, str._install
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
jne 0x140081fd3
call fcn.140080ea8
lea rcx, str.Mesh_Agent
call fcn.140080c90
lea rcx, [0x1401e3898]
call fcn.140080c90
call fcn.140080b04
cmp eax, edi
lea rcx, str.Mesh_agent_installed
je 0x140081f93
lea rcx, str.Failed_to_install_mesh_agent
call fcn.140001090
mov r8d, r15d
lea rdx, [rsp + 0x550]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 5
jbe 0x1400827e9
lea rcx, [rsp + 0x550]
call fcn.140080178
lea rcx, [rsp + 0x550]
call fcn.14007fcec
jmp 0x1400827e9
cmp r14d, edi
jle 0x14008226d
lea rdx, str._remove
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
je 0x140082008
lea rdx, str._uninstall
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
jne 0x1400820aa
call fcn.140080ea8
lea rcx, [0x1401e3898]
call fcn.140080c90
lea rcx, str.Mesh_Agent
call fcn.140080c90
mov dword [rsp + 0x40], eax
test eax, eax
jne 0x140082036
lea rcx, str.Failed_to_uninstall_mesh_agent
jmp 0x14008204f
cmp eax, edi
jne 0x140082043
lea rcx, str.Mesh_agent_uninstalled
jmp 0x14008204f
cmp eax, 2
jne 0x140082054
lea rcx, str.Mesh_agent_still_running
call fcn.140001090
lea rdx, str.SoftwareOpen_SourceMeshAgent2
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea rdx, str.SoftwareOpen_SourceMeshAgent2
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov r8d, r15d
lea rdx, [rsp + 0x550]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 5
jbe 0x1400827e9
lea rcx, [rsp + 0x550]
call fcn.140080178
jmp 0x1400827e9
cmp r14d, edi
jle 0x14008226d
mov rdx, qword [rsi + 8]
mov rax, qword [rdx]
cmp rax, qword [str._update:]
jne 0x1400820f2
jmp 0x1400820d4
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rsi + 8]
xor r8d, r8d
add rdx, 8
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x1400820c5
call fcn.140080dec
jmp 0x1400827e9
cmp r14d, edi
jle 0x14008226d
lea rdx, str._netinfo
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
jne 0x14008212b
lea rcx, [rsp + 0x48]
call fcn.140009924
test eax, eax
jle 0x1400827e9
mov rcx, qword [rsp + 0x48]
jmp 0x14008275d
cmp r14d, edi
jle 0x14008226d
lea rdx, str._fullinstall
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
jne 0x140082189
test r13, r13
jne 0x140082152
mov rdi, rbx
jmp 0x140082160
mov rdx, r15
mov rcx, r13
call fcn.140163e74
mov rdi, rax
mov rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x140082178
mov rdx, r15
mov rcx, rsi
call fcn.140163e74
mov rbx, rax
mov dword [rsp + 0x20], edi
mov r9, r13
mov r8d, ebx
mov rdx, rsi
xor ecx, ecx
jmp 0x1400821b4
cmp r14d, edi
jle 0x14008226d
lea rdx, str._fulluninstall
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
jne 0x1400821be
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, edi
call fcn.14008104c
jmp 0x1400827e9
cmp r14d, edi
jle 0x14008226d
lea rdx, str._setfirewall
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
jne 0x14008221f
mov r8d, r15d
lea rdx, [rsp + 0x550]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1400803fc
test eax, eax
jne 0x140082203
lea rcx, str.Must_run_as_administrator
jmp 0x14008275d
lea rcx, [rsp + 0x550]
call fcn.140080178
lea rcx, [rsp + 0x550]
call fcn.14007fcec
jmp 0x140082261
cmp r14d, edi
jle 0x14008226d
lea rdx, str._clearfirewall
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
jne 0x14008226d
mov r8d, r15d
lea rdx, [rsp + 0x550]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1400803fc
test eax, eax
je 0x1400821f7
lea rcx, [rsp + 0x550]
call fcn.140080178
lea rcx, str.Done
jmp 0x14008275d
cmp r14d, 2
jne 0x1400826dc
lea rdx, str._nodeidhex
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
jne 0x1400823b6
mov dword [rsp + 0x30], ebx
mov rsi, rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
lea rdx, str.SoftwareOpen_SourceMeshAgent2
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14008239d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.NodeId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140082392
cmp dword [rsp + 0x30], ebx
jbe 0x140082392
mov ecx, dword [rsp + 0x30]
call fcn.140164508
mov rsi, rax
test rax, rax
jne 0x140082352
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov edi, 0xfe
mov r9d, edi
mov ebx, 0x437
mov r8d, ebx
lea rdx, str.ServiceMain.c
xor ecx, ecx
call fcn.14006ddcc
mov r8d, ebx
lea rdx, str.ServiceMain.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.140001090
mov ecx, edi
call fcn.14015e4d8
int3
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.NodeId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140082383
cmp dword [rsp + 0x30], ebx
jne 0x140082392
mov rcx, rsi
call fcn.1401630c0
mov rsi, rbx
mov dword [rsp + 0x30], ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rsi, rsi
mov rcx, rsi
jne 0x1400823ac
lea rcx, str.Not_defined__start_the_mesh_service_to_create_a_nodeid.
call fcn.140001090
jmp 0x140081b38
cmp r14d, 2
jne 0x1400826dc
lea rdx, str._info
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
jne 0x14008263f
mov dword [rsp + 0x30], ebx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
lea rdx, str.SoftwareOpen_SourceMeshAgent2
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140081b38
mov esi, 0x10000
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdi, [0x140204120]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.NodeId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
jne 0x14008245e
lea rcx, str.NodeId:_____none_
call fcn.140001090
jmp 0x14008246d
mov rdx, rdi
lea rcx, str.NodeId:_____s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MeshId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x1400824b8
mov rdx, rdi
lea rcx, str._r_nMeshId:_____s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.AgentHash
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x140082503
mov rdx, rdi
lea rcx, str._r_nAgentHash:__s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MeshServerId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x14008254e
mov rdx, rdi
lea rcx, str._r_nServerId:___s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MeshServerUrl
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x140082599
mov rdx, rdi
lea rcx, str._r_nServerUrl:__s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Proxy
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x1400825e4
mov rdx, rdi
lea rcx, str._r_nProxy:______s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401d5914]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x14008262f
mov rdx, rdi
lea rcx, str._r_nTag:________s
call fcn.140001090
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140081b38
cmp r14d, 2
jne 0x1400826dc
lea rdx, str._resetnodeid
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
jne 0x1400826dc
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SoftwareOpen_SourceMeshAgent2
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400826d0
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 2]
xor r8d, r8d
lea rdx, str.ResetNodeId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14008262f
lea rcx, str.NodeID_will_be_reset_next_time_the_Mesh_Agent_service_is_started.
call fcn.140001090
jmp 0x14008262f
lea rcx, str.Error_writing_to_registry__try_running_this_as_administrator.
jmp 0x1400823ac
lea rcx, [0x1401e3898]
call fcn.140080c90
cmp r14d, edi
jle 0x140082767
mov dword [rsp + 0x20], edi
mov r9d, 3
lea r8, [0x1401d5f94]
or edx, 0xffffffff
mov rcx, qword [rsi + 8]
call fcn.14006d278
test eax, eax
je 0x140082756
mov edx, edi
lea rcx, [0x140081a60]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop
xor ecx, ecx
call fcn.140004b3c
mov qword [0x140202e50], rax
mov dword [rax + 0x728], edi
mov r8, rsi
mov edx, r14d
call fcn.140005f20
call fcn.140006370
nop
jmp 0x1400827e9
lea rcx, str.Mesh_Agent_available_switches:_r_n__run_______________Start_as_a_console_agent._r_n__connect___________Start_as_a_temporary_console_agent._r_n__start_____________Start_the_service._r_n__restart___________Restart_the_service._r_n__stop______________Stop_the_service._r_n__state_____________Display_the_running_state_of_the_service._r_n___signcheck________Perform_self_check._r_n___install__________Install_the_service_from_this_location._r_n___uninstall________Remove_the_service_from_this_location._r_n___nodeidhex________Return_the_current_agent_identifier._r_n___fullinstall______Copy_agent_into_program_files__install_and_launch._r_n___fulluninstall____Stop_agent_and_clean_up_the_program_files_location._r_n___proxy:host:port__Specifiy_an_HTTPS_proxy__after__fullinstall_only_._r_n___tag:xxx__________Specifiy_a_agent_tag___after__fullinstall_only_._r_n___resetnodeid______Reset_the_NodeID_next_time_the_service_is_started.
call fcn.140001090
jmp 0x1400827e9
lea rax, str.Mesh_Agent_background_service
mov qword [rsp + 0x58], rax
lea rax, [0x140080944]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x1400827e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x427
jne 0x1400827e9
call qword [sym.imp.KERNEL32.dll_FreeConsole]
call fcn.1400803fc
xor ecx, ecx
test eax, eax
jne 0x1400827d0
lea r9d, [rcx + 0x10]
lea r8, str.Mesh_Agent
lea rdx, str.Must_run_as_administrator
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1400827e9
mov qword [rsp + 0x20], rbx
lea r9, [0x140082cc4]
xor r8d, r8d
lea edx, [r8 + 0x67]
call qword [sym.imp.USER32.dll_DialogBoxParamA]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x140081b38
mov edx, edi
lea rcx, [0x140081a60]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop
mov r15d, ebx
mov dword [rsp + 0x44], ebx
cmp r14d, edi
jle 0x140082830
lea rdx, str.connect
mov rcx, qword [rsi + 8]
call fcn.14016c948
mov ecx, 0x20
test eax, eax
cmove r15d, ecx
mov dword [rsp + 0x44], r15d
mov ecx, r15d
call fcn.140004b3c
mov qword [0x140202e50], rax
mov qword [rax + 0x18], r12
mov ecx, dword [rsp + 0x30]
mov dword [rax + 0x20], ecx
test r12, r12
jne 0x140082883
cmp r14d, edi
jle 0x140082889
lea rdx, [0x1401d5df0]
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
je 0x14008287c
lea rdx, str.connect
mov rcx, qword [rsi + 8]
call fcn.14016c948
test eax, eax
jne 0x140082889
mov rax, qword [0x140202e50]
mov dword [rax + 0x728], edi
mov r8, rsi
mov edx, r14d
call fcn.140005f20
mov rax, qword [0x140202e50]
mov ebx, dword [rax + 0x724]
mov dword [rsp + 0x50], ebx
call fcn.140006370
nop
mov eax, ebx
jmp 0x1400828bd
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.14015bde0
lea r11, [rsp + 0x880]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret