Function at 0x49fb23
Capabilities:
Reference wmi statements
Set registry value
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x940]
sub esp, 0x940
push 0xfffffffffffffffe
push 0x6cb300
push 0x5bbd20
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x6d1d44]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x93c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 0x948]
mov dword [ebp - 0x30], edi
mov eax, dword [ebp + 0x94c]
mov dword [ebp - 0x24], eax
mov ecx, edi
shl ecx, 2
lea esi, [ecx + 4]
push 0xfffffffffffffffb
pop eax
sub eax, ecx
je 0x49fb9f
cmp esi, 0xffffffef
jae 0x49fb9f
lea eax, [edi*4 + 0x14]
push eax
call fcn.005f0a50
pop ecx
xor ebx, ebx
jmp 0x49fba3
xor ebx, ebx
mov eax, ebx
push ebx
push ebx
mov edx, esi
mov ecx, eax
call fcn.00484c1e
pop ecx
pop ecx
mov esi, eax
mov dword [ebp - 0x38], esi
test edi, edi
jle 0x49fc34
mov esi, dword [ebp - 0x24]
sub eax, esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], edi
mov edi, eax
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [esi]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
jae 0x49fbff
or ecx, 0xffffffff
sub ecx, eax
je 0x49fbff
cmp eax, 0xffffffef
jae 0x49fbff
add eax, 0x10
push eax
call fcn.005f0a50
pop ecx
mov ecx, eax
mov eax, dword [ebp - 0x24]
jmp 0x49fc01
mov ecx, ebx
push ebx
push ebx
mov edx, eax
call fcn.00484c1e
pop ecx
pop ecx
mov dword [edi + esi], eax
push ebx
push ebx
push dword [ebp - 0x24]
push eax
push 0xffffffffffffffff
push dword [esi]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esi, 4
sub dword [ebp - 0x2c], 1
jne 0x49fbc6
mov esi, dword [ebp - 0x38]
mov edi, dword [ebp - 0x30]
cmp edi, 1
jle 0x4a001f
push str._finstall
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
je 0x49fcc2
push str._funinstall
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
je 0x49fcc2
push 0x7448f0
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
je 0x49fcc2
push 0x744900
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
je 0x49fcc2
push str._install
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
je 0x49fcc2
push str._uninstall
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
je 0x49fcc2
push str._state
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x49fcf4
mov eax, dword [esi + 4]
mov dword [esi + edi*4], eax
push ebx
push ebx
push 0x14
call fcn.005f0a50
pop ecx
push 4
pop edx
mov ecx, eax
call fcn.00484c1e
mov dword [esi + 4], eax
push 0x744930
push dword [eax - 0x10]
push eax
call fcn.0040117f
add esp, 0x14
inc edi
mov dword [ebp - 0x30], edi
cmp edi, 1
jle 0x4a001f
push str._licenses
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a001f
push 0x744940
call fcn.00401109
mov dword [esp], str._MeshCentral_MeshAgent:_Copyright_2006___2022_Intel_Corporation_n
call fcn.00401109
mov dword [esp], str.________________________https:__github.com_Ylianst_MeshAgent__n
call fcn.00401109
mov dword [esp], 0x744aa0
call fcn.00401109
mov dword [esp], str.___Licensed_under_the_Apache_License__Version_2.0__the__License____n
call fcn.00401109
mov dword [esp], str.___you_may_not_use_this_file_except_in_compliance_with_the_License._n
call fcn.00401109
mov dword [esp], str.___You_may_obtain_a_copy_of_the_License_at_n
call fcn.00401109
mov dword [esp], 0x744c00
call fcn.00401109
mov dword [esp], str.___http:__www.apache.org_licenses_LICENSE_2.0_n
call fcn.00401109
mov dword [esp], 0x744c08
call fcn.00401109
mov dword [esp], str.___Unless_required_by_applicable_law_or_agreed_to_in_writing__software_n
call fcn.00401109
mov dword [esp], str.___distributed_under_the_License_is_distributed_on_an__AS_IS__BASIS__n
call fcn.00401109
mov dword [esp], str.___WITHOUT_WARRANTIES_OR_CONDITIONS_OF_ANY_KIND__either_express_or_implied._n
call fcn.00401109
mov dword [esp], str.___See_the_License_for_the_specific_language_governing_permissions_and_n
call fcn.00401109
mov dword [esp], str.___limitations_under_the_License._n_n
call fcn.00401109
mov dword [esp], 0x744d38
call fcn.00401109
mov dword [esp], str._Duktape_Javascript_Engine:_Copyright__c__2013_2019_by_Duktape_authors__see_AUTHORS.rst__n
call fcn.00401109
mov dword [esp], str.________________________https:__github.com_svaarala_duktape__n
call fcn.00401109
mov dword [esp], str.________________________http:__opensource.org_licenses_MIT__n
call fcn.00401109
mov dword [esp], 0x744ee8
call fcn.00401109
mov dword [esp], str.___Permission_is_hereby_granted__free_of_charge__to_any_person_obtaining_a_copy_n
call fcn.00401109
mov dword [esp], str.___of_this_software_and_associated_documentation_files_the__Software____to_deal_n
call fcn.00401109
mov dword [esp], str.___in_the_Software_without_restriction__including_without_limitation_the_rights_n
call fcn.00401109
mov dword [esp], str.___to_use__copy__modify__merge__publish__distribute__sublicense__and___or_sell_n
call fcn.00401109
mov dword [esp], str.___copies_of_the_Software__and_to_permit_persons_to_whom_the_Software_is_n
call fcn.00401109
mov dword [esp], str.___furnished_to_do_so__subject_to_the_following_conditions_:_n
call fcn.00401109
mov dword [esp], 0x7451b4
call fcn.00401109
mov dword [esp], str.___The_above_copyright_notice_and_this_permission_notice_shall_be_included_in_n
call fcn.00401109
mov dword [esp], str.___all_copies_or_substantial_portions_of_the_Software._n
call fcn.00401109
mov dword [esp], str.____n
call fcn.00401109
mov dword [esp], str.___THE_SOFTWARE_IS_PROVIDED__AS_IS___WITHOUT_WARRANTY_OF_ANY_KIND__EXPRESS_OR_n
call fcn.00401109
mov dword [esp], str.___IMPLIED__INCLUDING_BUT_NOT_LIMITED_TO_THE_WARRANTIES_OF_MERCHANTABILITY__n
call fcn.00401109
mov dword [esp], str.___FITNESS_FOR_A_PARTICULAR_PURPOSE_AND_NONINFRINGEMENT.IN_NO_EVENT_SHALL_THE_n
call fcn.00401109
mov dword [esp], str.___AUTHORS_OR_COPYRIGHT_HOLDERS_BE_LIABLE_FOR_ANY_CLAIM__DAMAGES_OR_OTHER_n
call fcn.00401109
mov dword [esp], str.___LIABILITY__WHETHER_IN_AN_ACTION_OF_CONTRACT__TORT_OR_OTHERWISE__ARISING_FROM__n
call fcn.00401109
mov dword [esp], str.___OUT_OF_OR_IN_CONNECTION_WITH_THE_SOFTWARE_OR_THE_USE_OR_OTHER_DEALINGS_IN_n
call fcn.00401109
mov dword [esp], str.___THE_SOFTWARE._n
call fcn.00401109
mov dword [esp], str._n
call fcn.00401109
mov dword [esp], str.ZLIB_Data_Compression_Library:_Copyright__c__1995_2017_Jean_loup_Gailly_and_Mark_Adler_n
call fcn.00401109
mov dword [esp], str._______________________________http:__www.zlib.net__n
call fcn.00401109
mov dword [esp], str._________________________________________________________________________________________n
call fcn.00401109
mov dword [esp], str.___This_software_is_provided_as_is__without_any_express_or_implied_n
call fcn.00401109
mov dword [esp], str.___warranty.In_no_event_will_the_authors_be_held_liable_for_any_damages_n
call fcn.00401109
mov dword [esp], str.___arising_from_the_use_of_this_software._n
call fcn.00401109
mov dword [esp], 0x744d94
call fcn.00401109
mov dword [esp], str.___Permission_is_granted_to_anyone_to_use_this_software_for_any_purpose__n
call fcn.00401109
mov dword [esp], str.___including_commercial_applications__and_to_alter_it_and_redistribute_it_n
call fcn.00401109
mov dword [esp], str.___freely__subject_to_the_following_restrictions_:_n
call fcn.00401109
mov dword [esp], 0x744f44
call fcn.00401109
mov dword [esp], str.___1._The_origin_of_this_software_must_not_be_misrepresented__you_must_not_n
call fcn.00401109
mov dword [esp], str.______claim_that_you_wrote_the_original_software.If_you_use_this_software_n
call fcn.00401109
mov dword [esp], str.______in_a_product__an_acknowledgment_in_the_product_documentation_would_be_n
call fcn.00401109
mov dword [esp], str.______appreciated_but_is_not_required._n
call fcn.00401109
mov dword [esp], str.___2._Altered_source_versions_must_be_plainly_marked_as_such__and_must_not_be_n
call fcn.00401109
mov dword [esp], str.______misrepresented_as_being_the_original_software._n
call fcn.00401109
mov dword [esp], str.___3._This_notice_may_not_be_removed_or_altered_from_any_source_distribution._n
call fcn.00401109
mov dword [esp], 0x744fc4
call fcn.00401109
mov dword [esp], str.___Jean___loup_Gailly________Mark_Adler_n
call fcn.00401109
mov dword [esp], str.___jloup_gzip.org____________madler_alumni.caltech.edu_n
call fcn.00401109
pop ecx
test dword [esi - 0x10], 0xfffffffc
jbe 0x49fff3
mov ecx, dword [esi + ebx*4]
call fcn.00484cd3
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x49ffe0
mov ecx, esi
call fcn.00484cd3
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x93c]
xor ecx, ebp
call fcn.005b8900
lea esp, [ebp + 0x940]
pop ebp
ret
mov ecx, ebx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], ecx
mov eax, ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
cmp edi, 1
jle 0x4a00d5
push str._info
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a00d5
push str.Apr__4_2022
push str.10:13:50
push str.Compiled_on:__s___s_n
call fcn.00401109
push str.2fc1af473a96b5ad64011fd0575cfa15ee36d769
push str.___Commit_Hash:__s_n
call fcn.00401109
push 0x7454a4
push str.___Commit_Date:__s_n
call fcn.00401109
push ebx
call fcn.004bccb0
push eax
push str.Using__s_n
call fcn.00401109
push 3
push str.Agent_ARCHID:__d_n
call fcn.00401109
add esp, 0x30
push 0x66
pop ecx
mov esi, str.var__tmp__Detected_OS:___require_os_.Name__try_tmp________require_os_.arch____catch_x_console.log__tmp__if_process.platformwin32___tmprequire_win_authenticode_opus__process.execPath___if__tmp_null___tmp.url_null___tmprequire_win_authenticode_opus_.locked__tmp.url___if__tmp_null___console.log_LOCKED_to:____tmp.dns___console.log_______tmp.id______process.exit___
lea edi, [ebp + 0x7a4]
rep movsd dword es:[edi], dword [esi]
mov esi, 0x197
mov dword [ebp - 0x20], esi
mov edx, esi
lea ecx, [ebp + 0x7a4]
call fcn.0048bfc8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], esi
mov esi, dword [ebp - 0x38]
mov edi, dword [ebp - 0x30]
cmp edi, 2
jle 0x4a01c5
push str._faddr
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a0149
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x24]
push eax
push 0x74570c
mov eax, dword [esi + 8]
add eax, 2
push eax
call fcn.0040c244
push ebx
push dword [ebp - 0x24]
call fcn.00486550
push 0x751940
push 0x74575c
call fcn.00401109
add esp, 0x1c
test dword [esi - 0x10], 0xfffffffc
jbe 0x49fff3
mov ecx, dword [esi + ebx*4]
call fcn.00484cd3
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x4a0131
jmp 0x49fff3
cmp edi, 2
jle 0x4a01c5
push str._fdelta
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a01c5
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
push eax
push str._lld
push dword [esi + 8]
call fcn.0040c244
mov ecx, 0x4853e7
xor eax, eax
sub ecx, dword [ebp - 0x28]
sbb eax, dword [ebp - 0x24]
push eax
push ecx
call fcn.00486550
push 0x751940
push 0x7457b4
call fcn.00401109
add esp, 0x1c
test dword [esi - 0x10], 0xfffffffc
jbe 0x49fff3
mov ecx, dword [esi + ebx*4]
call fcn.00484cd3
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x4a01ad
jmp 0x49fff3
cmp dword [ebp - 0x34], 0
je 0x4a01d2
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4a0227
push 0x104
lea eax, [ebp + 0x734]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push ebx
push 0x208
lea eax, [ebp + 0x52c]
push eax
push 0xffffffffffffffff
lea eax, [ebp + 0x734]
push eax
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x2c]
lea ecx, [ebp + 0x52c]
call fcn.00476ffd
pop ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
cmp edi, 2
jle 0x4a0319
mov edx, str._exec
mov ecx, dword [esi + 4]
mov al, byte [ecx]
mov byte [ebp - 0x19], al
cmp al, byte [edx]
mov eax, dword [ebp - 0x20]
jne 0x4a0268
cmp byte [ebp - 0x19], 0
je 0x4a0264
mov al, byte [ecx + 1]
mov byte [ebp - 0x19], al
cmp al, byte [edx + 1]
mov eax, dword [ebp - 0x20]
jne 0x4a0268
add ecx, 2
add edx, 2
cmp byte [ebp - 0x19], 0
jne 0x4a0238
mov ecx, ebx
jmp 0x4a026d
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x4a029f
test eax, eax
jne 0x4a029f
xor edx, edx
mov ecx, dword [esi + 8]
call fcn.0048bfc8
mov ecx, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], ecx
test ecx, ecx
jne 0x4a028f
mov eax, ebx
jmp 0x4a029c
push 0x1000
push ecx
call fcn.005f01d0
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
cmp edi, 2
jle 0x4a0319
mov edx, str._b64exec
mov ecx, dword [esi + 4]
mov al, byte [ecx]
mov byte [ebp - 0x19], al
cmp al, byte [edx]
mov eax, dword [ebp - 0x20]
jne 0x4a02dc
cmp byte [ebp - 0x19], 0
je 0x4a02d8
mov al, byte [ecx + 1]
mov byte [ebp - 0x19], al
cmp al, byte [edx + 1]
mov eax, dword [ebp - 0x20]
jne 0x4a02dc
add ecx, 2
add edx, 2
cmp byte [ebp - 0x19], 0
jne 0x4a02ac
mov ecx, ebx
jmp 0x4a02e1
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x4a0319
test eax, eax
jne 0x4a0319
cmp dword [esi + 8], eax
jne 0x4a02f2
mov eax, ebx
jmp 0x4a0301
push 0x10000
push dword [esi + 8]
call fcn.005f01d0
pop ecx
pop ecx
lea ecx, [ebp - 0x2c]
push ecx
mov edx, eax
mov ecx, dword [esi + 8]
call fcn.0048a730
pop ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
cmp edi, 1
jle 0x4a03f2
push str._nodeid
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a0361
push 0xd
pop ecx
mov esi, str.console.log_require__agentNodeId_____process.exit___
lea edi, [ebp + 0x904]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x36
pop esi
mov dword [ebp - 0x20], esi
mov edx, esi
lea ecx, [ebp + 0x904]
call fcn.0048bfc8
mov dword [ebp - 0x34], eax
mov edi, dword [ebp - 0x30]
cmp edi, 1
jle 0x4a03f2
push str._name
mov eax, dword [ebp - 0x38]
push dword [eax + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a03ac
push 0x10
pop ecx
mov esi, str.console.log_require__agentNodeId_.serviceName____process.exit___
lea edi, [ebp + 0x8f8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x42
pop eax
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x8f8]
call fcn.0048bfc8
mov dword [ebp - 0x34], eax
mov edi, dword [ebp - 0x30]
cmp edi, 1
jle 0x4a03f2
push str.state
mov esi, dword [ebp - 0x38]
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a03f5
push 0x2b
pop ecx
mov esi, str.tryconsole.log_require_service_manager_.manager.getService_require__agentNodeId_.serviceName___.status.state__catch_z_console.log_NOT_INSTALLED___process.exit___
lea edi, [ebp + 0x890]
rep movsd dword es:[edi], dword [esi]
mov eax, 0xab
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x890]
call fcn.0048bfc8
mov dword [ebp - 0x34], eax
mov edi, dword [ebp - 0x30]
mov esi, dword [ebp - 0x38]
cmp edi, 1
jle 0x4a04aa
push str.start
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
je 0x4a0424
push str._start
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a0451
push 0x30
pop ecx
mov esi, str.tryrequire_service_manager_.manager.getService_require__agentNodeId_.serviceName___.start___console.log_Service_Started__catch_z_console.log_Failed_to_start_service__process.exit___
lea edi, [ebp + 0x878]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, 0xc1
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x878]
call fcn.0048bfc8
mov dword [ebp - 0x34], eax
mov edi, dword [ebp - 0x30]
cmp edi, 1
jle 0x4a04aa
push str.stop
mov esi, dword [ebp - 0x38]
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
je 0x4a047f
push str._stop
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a04ad
push 0x44
pop ecx
mov esi, str.tryrequire_service_manager_.manager.getService_require__agentNodeId_.serviceName___.stop__.then_function_m_console.log_Service_Stopped__process.exit_____function_m_console.log_m__process.exit_____catch_z_console.log_Failed_to_stop_service__process.exit___
lea edi, [ebp + 0x82c]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x10f
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x82c]
call fcn.0048bfc8
mov dword [ebp - 0x34], eax
mov edi, dword [ebp - 0x30]
mov esi, dword [ebp - 0x38]
cmp edi, 1
jle 0x4a0551
push str.restart
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
je 0x4a04dc
push str._restart
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a0507
push 0x46
pop ecx
mov esi, str.tryrequire_service_manager_.manager.getService_require__agentNodeId_.serviceName___.restart__.then_function_m_console.log_Service_Restarted__process.exit_____function_m_console.log_m__process.exit_____catch_z_console.log_Failed_to_restart_service__process.exit___
lea edi, [ebp + 0x824]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x117
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x824]
call fcn.0048bfc8
mov dword [ebp - 0x34], eax
mov edi, dword [ebp - 0x30]
cmp edi, 1
jle 0x4a0551
push str._agentHash
mov esi, dword [ebp - 0x38]
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a0554
cmp dword [ebp - 0x20], eax
jne 0x4a0554
push 0x18
pop ecx
mov esi, str.console.log_getSHA384FileHash_process.execPath_.toString_hex_.substring_0_16___process.exit___
lea edi, [ebp + 0x8d8]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x60
pop eax
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x8d8]
call fcn.0048bfc8
mov dword [ebp - 0x34], eax
mov edi, dword [ebp - 0x30]
mov esi, dword [ebp - 0x38]
cmp edi, 1
jle 0x4a059b
push str._agentFullHash
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a059b
cmp dword [ebp - 0x20], eax
jne 0x4a059b
push 0x14
pop ecx
mov esi, str.console.log_getSHA384FileHash_process.execPath_.toString_hex___process.exit___
lea edi, [ebp + 0x8e8]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x50
pop eax
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x8e8]
call fcn.0048bfc8
mov dword [ebp - 0x34], eax
mov edi, dword [ebp - 0x30]
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, dword [ebp - 0x38]
cmp edi, 1
jle 0x4a0832
push str._updaterversion
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a0602
push ebx
lea eax, [ebp - 0x24]
push eax
push 2
push 0x745c0c
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test dword [esi - 0x10], 0xfffffffc
jbe 0x49fff3
mov ecx, dword [esi + ebx*4]
call fcn.00484cd3
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x4a05ea
jmp 0x49fff3
cmp edi, 1
jle 0x4a0832
push str._kvm0
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a0717
push ebx
push ebx
xor edx, edx
push 0x10
pop ecx
call fcn.00484ef6
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
mov dword [eax], 0x49fad8
mov dword [eax + 8], ebx
cmp edi, 2
jle 0x4a0659
push 0x745ce4
push dword [esi + 8]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a0659
xor ecx, ecx
inc ecx
jmp 0x4a065b
mov ecx, ebx
mov eax, dword [ebp - 0x24]
mov dword [eax + 0xc], ecx
cmp edi, 2
jle 0x4a0679
push 0x745fe4
push dword [esi + 8]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
je 0x4a0691
cmp edi, 3
jle 0x4a069b
push 0x745ff4
push dword [esi + 0xc]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a069b
mov dword [0x74c938], 1
push 0x800
push ebx
push 0x745f84
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
mov eax, ebx
test edi, edi
je 0x4a06d3
push 0x746004
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x4a06d7
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4a06e4
push 2
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4a06ea
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
push dword [ebp - 0x24]
call fcn.0040da41
test dword [esi - 0x10], 0xfffffffc
jbe 0x49fff3
mov ecx, dword [esi + ebx*4]
call fcn.00484cd3
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x4a06ff
jmp 0x49fff3
cmp edi, 1
jle 0x4a0832
push str._kvm1
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a0832
push ebx
push ebx
xor edx, edx
push 0x10
pop ecx
call fcn.00484ef6
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
mov dword [eax], 0x49fad8
mov dword [eax + 8], 1
cmp edi, 2
jle 0x4a0772
push str._coredump
push dword [esi + 8]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a0772
xor ecx, ecx
inc ecx
jmp 0x4a0774
mov ecx, ebx
mov eax, dword [ebp - 0x24]
mov dword [eax + 0xc], ecx
cmp edi, 2
jle 0x4a0792
push 0x746030
push dword [esi + 8]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
je 0x4a07aa
cmp edi, 3
jle 0x4a07b4
push str._remotecursor
push dword [esi + 0xc]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a07b4
mov dword [0x74c938], 1
push 0x800
push ebx
push str.Shcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
mov eax, ebx
test edi, edi
je 0x4a07ec
push str.SetProcessDpiAwareness
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x4a07f0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4a07fd
push 2
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4a0803
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
push dword [ebp - 0x24]
call fcn.0040da41
mov edi, ebx
test dword [esi - 0x10], 0xfffffffc
jbe 0x4a14a1
mov ecx, dword [esi + edi*4]
call fcn.00484cd3
inc edi
mov eax, dword [esi - 0x10]
shr eax, 2
cmp edi, eax
jl 0x4a081a
jmp 0x4a14a1
cmp dword [ebp - 0x34], 0
jne 0x4a13cc
test edi, edi
jle 0x4a0856
push 0x746074
push dword [esi]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
je 0x4a13cc
cmp edi, 1
jle 0x4a0b59
push 0x74607c
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
je 0x4a13cc
push 0x746080
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
je 0x4a13cc
push str.__slave
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
je 0x4a13cc
cmp edi, 1
jle 0x4a0b59
mov ecx, dword [esi + 4]
mov edx, str._update:
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4a0a69
mov eax, dword [ecx + 4]
cmp eax, dword [edx + 4]
jne 0x4a0a69
push ebx
push ebx
xor edx, edx
mov ecx, 0x400
call fcn.00484ef6
pop ecx
pop ecx
mov edx, eax
mov dword [ebp - 0x2c], edx
mov ecx, dword [esi + 4]
cmp byte [ecx + 8], 0x2a
jne 0x4a0926
cmp edi, 2
jle 0x4a08f3
mov eax, dword [esi + 8]
jmp 0x4a08f8
mov eax, str.null
push eax
mov eax, str.true
mov dword [ebp - 0x24], str.false
cmp byte [ecx + 9], 0x53
cmovne eax, dword [ebp - 0x24]
push eax
push str.require_agent_installer_.update__s___s__
push 0x400
push edx
call fcn.0040117f
add esp, 0x14
jmp 0x4a09dc
cmp edi, 2
jle 0x4a09c9
mov ecx, 0x7460f8
mov eax, dword [esi + 8]
mov dl, byte [eax]
mov byte [ebp - 0x19], dl
cmp dl, byte [ecx]
mov edx, dword [ebp - 0x2c]
jne 0x4a0967
cmp byte [ebp - 0x19], 0
je 0x4a0963
mov dl, byte [eax + 1]
mov byte [ebp - 0x19], dl
cmp dl, byte [ecx + 1]
mov edx, dword [ebp - 0x2c]
jne 0x4a0967
add eax, 2
add ecx, 2
cmp byte [ebp - 0x19], 0
jne 0x4a0937
mov eax, ebx
jmp 0x4a096c
sbb eax, eax
or eax, 1
test eax, eax
je 0x4a09b1
mov ecx, 0x7460fc
mov eax, dword [esi + 8]
mov dl, byte [eax]
mov byte [ebp - 0x19], dl
cmp dl, byte [ecx]
mov edx, dword [ebp - 0x2c]
jne 0x4a09a8
cmp byte [ebp - 0x19], 0
je 0x4a09a4
mov dl, byte [eax + 1]
mov byte [ebp - 0x19], dl
cmp dl, byte [ecx + 1]
mov edx, dword [ebp - 0x2c]
jne 0x4a09a8
add eax, 2
add ecx, 2
cmp byte [ebp - 0x19], 0
jne 0x4a0978
mov eax, ebx
jmp 0x4a09ad
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4a09c9
push dword [esi + 8]
push str.require_agent_installer_.update_false____s___
push 0x400
push edx
call fcn.0040117f
add esp, 0x10
jmp 0x4a09dc
push str.require_agent_installer_.update_true__
push 0x400
push edx
call fcn.0040117f
add esp, 0xc
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 1
xor ecx, ecx
call fcn.004077ce
mov dword [0x74cc04], eax
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp - 0x24]
mov dword [eax + 0x14], ecx
push esi
mov edx, edi
call fcn.0040ade6
pop ecx
mov eax, dword [0x74cc04]
mov edi, dword [eax + 0xd34]
mov dword [ebp - 0x44], edi
call fcn.0040b46f
mov dword [0x74cc04], ebx
mov dword [ebp - 4], 0xfffffffe
test dword [esi - 0x10], 0xfffffffc
jbe 0x4a149f
mov ecx, dword [esi + ebx*4]
call fcn.00484cd3
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x4a0a34
jmp 0x4a149f
cmp edi, 1
jle 0x4a0b59
push str._netinfo
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a0aa2
lea ecx, [ebp - 0x24]
call fcn.0040f56e
test eax, eax
jle 0x4a13a1
push dword [ebp - 0x24]
call fcn.0049f52d
jmp 0x4a0f1e
cmp edi, 1
jle 0x4a0b59
push str._setfirewall
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a0b05
mov edi, 0x104
push edi
lea eax, [ebp + 0x324]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.0049f76b
test eax, eax
jne 0x4a0ae5
push 0x746180
jmp 0x4a0f19
lea ecx, [ebp + 0x324]
call fcn.0049f2f2
lea ecx, [ebp + 0x324]
call fcn.0049ef1a
push 0x74619c
jmp 0x4a0f19
cmp edi, 1
jle 0x4a0b59
push str._clearfirewall
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a0b59
mov edi, 0x104
push edi
lea eax, [ebp + 0x324]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.0049f76b
test eax, eax
jne 0x4a0b44
push str.Must_run_as_administrator
jmp 0x4a0f19
lea ecx, [ebp + 0x324]
call fcn.0049f2f2
push str.Done
jmp 0x4a0f19
cmp edi, 2
jne 0x4a0c01
push str._resetnodeid
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a0c01
lea eax, [ebp - 0x24]
push eax
push 0x20206
push ebx
push str.SoftwareOpen_SourceMeshAgent2
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4a0bcf
mov dword [ebp - 0x40], 1
push 4
lea eax, [ebp - 0x40]
push eax
push 4
push ebx
push str.ResetNodeId
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4a0bc4
push str.NodeID_will_be_reset_next_time_the_Mesh_Agent_service_is_started.
call fcn.00401109
pop ecx
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4a0bda
push str.Error_writing_to_registry__try_running_as_administrator.
call fcn.00401109
pop ecx
mov edi, ebx
test dword [esi - 0x10], 0xfffffffc
jbe 0x4a14a1
mov ecx, dword [esi + edi*4]
call fcn.00484cd3
inc edi
mov eax, dword [esi - 0x10]
shr eax, 2
cmp edi, eax
jl 0x4a0be9
jmp 0x4a14a1
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x54], str.Mesh_Agent_background_service
mov dword [ebp - 0x50], 0x49f8e9
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [0x74d6a0], edi
mov dword [0x74d698], esi
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x4a13a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x427
jne 0x4a13a1
cmp edi, 2
jl 0x4a0e33
push 1
push 3
push 0x746294
or edx, 0xffffffff
mov ecx, dword [esi + 4]
call fcn.0048bcb7
add esp, 0xc
test eax, eax
jne 0x4a0c86
push 1
push 4
push str..zip
or edx, 0xffffffff
mov ecx, dword [esi + 4]
call fcn.0048bcb7
add esp, 0xc
test eax, eax
je 0x4a0ce7
push 1
push 0x49fafe
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov dword [ebp - 4], 2
xor ecx, ecx
call fcn.004077ce
mov dword [0x74cc04], eax
mov dword [eax + 0xd68], 1
push esi
mov edx, edi
call fcn.0040ade6
pop ecx
call fcn.0040b46f
mov dword [0x74cc04], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x4a13a1
cmp edi, 2
jne 0x4a0e33
mov ecx, 0x7462a0
mov eax, dword [esi + 4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4a0d18
test dl, dl
je 0x4a0d14
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4a0d18
add eax, 2
add ecx, 2
test dl, dl
jne 0x4a0cf8
mov eax, ebx
jmp 0x4a0d1d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4a0dd9
mov edi, 0x104
push edi
lea eax, [ebp + 0x52c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
lea eax, [ebp + 0x838]
push eax
or edx, 0xffffffff
lea ecx, [ebp + 0x52c]
call fcn.0048461b
pop ecx
pop ecx
xor ecx, ecx
call fcn.004852a0
mov edi, eax
mov ecx, edi
call fcn.00487db9
push edi
push ebx
push ebx
lea eax, [ebp + 0x838]
push eax
push ebx
push ebx
push edi
push ebx
call fcn.00479238
xor edx, edx
mov ecx, eax
call fcn.00479abd
add esp, 0x20
mov dword [ebp - 0x24], eax
push 0xe88
push ecx
mov edx, str.require_util_language_.current.toUpperCase__.split___.join____
mov ecx, eax
call fcn.00417a90
pop ecx
pop ecx
test eax, eax
jne 0x4a0db5
push ebx
or edx, 0xffffffff
mov ecx, dword [ebp - 0x24]
call fcn.0041a1c6
push eax
push str.Current_Language:__s_n
call fcn.00401109
add esp, 0xc
mov ecx, dword [ebp - 0x24]
call fcn.0045bb3a
mov dword [edi], 2
mov ecx, edi
call fcn.0048549f
mov ecx, edi
call fcn.00487e4a
xor eax, eax
inc eax
mov edi, eax
mov dword [ebp - 0x24], eax
cmp edi, 2
jne 0x4a0e33
mov ecx, dword [esi + 4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a0de4
sub ecx, edx
cmp ecx, 6
jbe 0x4a0e33
push 6
push str._lang
push dword [esi + 4]
call fcn.005e88d0
add esp, 0xc
test eax, eax
jne 0x4a0e33
mov ecx, dword [esi + 4]
mov edx, ecx
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4a0e10
sub edx, edi
push 1
push 0x746310
call fcn.0048bd79
pop ecx
pop ecx
inc eax
add eax, dword [esi + 4]
mov dword [0x74cc24], eax
xor edi, edi
inc edi
cmp edi, 1
je 0x4a0f24
push str.Mesh_Agent_available_switches:_r_n
call fcn.00401109
mov dword [esp], str.__run_______________Start_as_a_console_agent._r_n
call fcn.00401109
mov dword [esp], str.__connect___________Start_as_a_temporary_console_agent._r_n
call fcn.00401109
mov dword [esp], str.__start_____________Start_the_service._r_n
call fcn.00401109
mov dword [esp], str.__restart___________Restart_the_service._r_n
call fcn.00401109
mov dword [esp], str.__stop______________Stop_the_service._r_n
call fcn.00401109
mov dword [esp], str.__state_____________Display_the_running_state_of_the_service._r_n
call fcn.00401109
mov dword [esp], str.___signcheck________Perform_self___check._r_n
call fcn.00401109
mov dword [esp], str.___install__________Install_the_service_from_this_location._r_n
call fcn.00401109
mov dword [esp], str.___uninstall________Remove_the_service_from_this_location._r_n
call fcn.00401109
mov dword [esp], str.___nodeid_t_t_tReturn_the_current_agent_identifier._r_n
call fcn.00401109
mov dword [esp], str.___resetnodeid______Reset_the_NodeID_next_time_the_service_is_started._r_n
call fcn.00401109
mov dword [esp], str.___fulluninstall____Stop_agent_and_clean_up_the_program_files_location._r_n
call fcn.00401109
mov dword [esp], str.___fullinstall______Copy_agent_into_program_files__install_and_launch._r_n
call fcn.00401109
mov dword [esp], 0x746544
call fcn.00401109
mov dword [esp], str.____________________The_following_switches_can_be_specified_after__fullinstall:_r_n
call fcn.00401109
mov dword [esp], 0x746594
call fcn.00401109
mov dword [esp], str._______WebProxy_http:__proxyhost:port_______Specify_an_HTTPS_proxy._r_n
call fcn.00401109
mov dword [esp], str._______agentName_alternate_name_____________Specify_an_alternate_name_to_be_provided_by_the_agent._r_n
call fcn.00401109
pop ecx
jmp 0x4a13a1
cmp dword [ebp - 0x24], 0
jne 0x4a13a1
mov dword [ebp - 0x30], ebx
mov edi, 0x104
push edi
lea eax, [ebp + 0x52c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
lea eax, [ebp + 0x838]
push eax
or edx, 0xffffffff
lea ecx, [ebp + 0x52c]
call fcn.0048461b
pop ecx
pop ecx
xor ecx, ecx
call fcn.004852a0
mov edi, eax
mov dword [ebp - 0x2c], edi
mov ecx, edi
call fcn.00487db9
push edi
push ebx
push ebx
lea eax, [ebp + 0x838]
push eax
push ebx
push ebx
push edi
push ebx
call fcn.00479238
xor edx, edx
mov ecx, eax
call fcn.00479abd
add esp, 0x20
mov edi, eax
push 0xe88
push ecx
mov edx, str.require_win_authenticode_opus_.checkMSH___
mov ecx, edi
call fcn.00417a90
pop ecx
pop ecx
test eax, eax
jne 0x4a136a
push 0xe88
push ecx
mov edx, str.require_util_language_.current.toLowerCase__.split___.join____
mov ecx, edi
call fcn.00417a90
pop ecx
pop ecx
test eax, eax
jne 0x4a0fd4
push ebx
or edx, 0xffffffff
mov ecx, edi
call fcn.0041a1c6
pop ecx
mov dword [ebp - 0x30], eax
push 0xe88
push ecx
mov edx, str._function_foo__return_JSON.parse__MSH__.translation______
mov ecx, edi
call fcn.00417a90
pop ecx
pop ecx
test eax, eax
jne 0x4a1004
push 0x74666c
or edx, 0xffffffff
mov ecx, edi
call fcn.00418622
pop ecx
test eax, eax
jne 0x4a11ab
mov ecx, edi
call fcn.0041b4b6
mov edx, str.Install
mov ecx, edi
call fcn.0041b0d2
push 0x746800
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00418449
mov edx, 0x7466cc
mov ecx, edi
call fcn.0041b0d2
mov dword [esp], 0x746808
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00418449
mov edx, 0x746814
mov ecx, edi
call fcn.0041b0d2
mov dword [esp], 0x74681c
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00418449
mov edx, str.Disconnect
mov ecx, edi
call fcn.0041b0d2
mov dword [esp], 0x746830
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00418449
mov edx, str.Update
mov ecx, edi
call fcn.0041b0d2
mov dword [esp], 0x746844
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00418449
mov ecx, edi
call fcn.0041b4d2
mov edx, str.NOT_INSTALLED
mov ecx, edi
call fcn.0041b0d2
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00419118
mov dword [esp], 0x74685c
or edx, 0xffffffff
mov ecx, edi
call fcn.004181f4
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.004190e2
push 0xfffffffffffffffd
pop edx
mov ecx, edi
call fcn.00419118
push ebx
xor edx, edx
inc edx
mov ecx, edi
call fcn.0041702b
mov ecx, edi
call fcn.0041c002
mov edx, str.RUNNING
mov ecx, edi
call fcn.0041b0d2
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00419118
push 0x74686c
or edx, 0xffffffff
mov ecx, edi
call fcn.004181f4
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.004190e2
push 0xfffffffffffffffd
pop edx
mov ecx, edi
call fcn.00419118
push ebx
xor edx, edx
inc edx
mov ecx, edi
call fcn.0041702b
mov ecx, edi
call fcn.0041c002
mov edx, str.NOT_RUNNING
mov ecx, edi
call fcn.0041b0d2
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00419118
push str.push
or edx, 0xffffffff
mov ecx, edi
call fcn.004181f4
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.004190e2
push 0xfffffffffffffffd
pop edx
mov ecx, edi
call fcn.00419118
push ebx
xor edx, edx
inc edx
mov ecx, edi
call fcn.0041702b
mov ecx, edi
call fcn.0041c002
push 0x746888
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00418449
push 0x746890
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00418449
add esp, 0x2c
mov eax, dword [0x74cc24]
test eax, eax
mov ecx, dword [ebp - 0x30]
cmovne ecx, eax
mov dword [ebp - 0x30], ecx
push ecx
or edx, 0xffffffff
mov ecx, edi
call fcn.00418622
pop ecx
test eax, eax
jne 0x4a125d
mov edx, dword [ebp - 0x30]
mov ecx, edi
call fcn.0041b0d2
or edx, 0xffffffff
mov ecx, edi
call fcn.00419118
push str.split
or edx, 0xffffffff
mov ecx, edi
call fcn.004181f4
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.004190e2
mov edx, 0x74689c
mov ecx, edi
call fcn.0041b0d2
xor edx, edx
inc edx
mov ecx, edi
call fcn.00416f8d
or edx, 0xffffffff
mov ecx, edi
call fcn.00419118
push str.shift
or edx, 0xffffffff
mov ecx, edi
call fcn.004181f4
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.004190e2
xor edx, edx
mov ecx, edi
call fcn.00416f8d
push ebx
or edx, 0xffffffff
mov ecx, edi
call fcn.0041a1c6
add esp, 0x14
mov dword [ebp - 0x30], eax
push 0xfffffffffffffffc
pop edx
mov ecx, edi
call fcn.00419118
push dword [ebp - 0x30]
or edx, 0xffffffff
mov ecx, edi
call fcn.00418622
pop ecx
mov ecx, 0x7468a8
test eax, eax
cmovne ecx, dword [ebp - 0x30]
mov dword [ebp - 0x24], ecx
mov eax, 0x7468ac
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4a129e
test dl, dl
je 0x4a129a
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4a129e
add eax, 2
add ecx, 2
test dl, dl
jne 0x4a127e
mov eax, ebx
jmp 0x4a12a3
sbb eax, eax
or eax, 1
test eax, eax
je 0x4a132b
push 0x7468b0
or edx, 0xffffffff
mov ecx, edi
call fcn.004181f4
push dword [ebp - 0x24]
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.004181f4
push 0x10
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.004188b5
push 1
or edx, 0xffffffff
mov ecx, edi
call fcn.004188dc
add esp, 0x10
jmp 0x4a131d
push 0xfffffffffffffffe
pop edx
call fcn.004195de
push eax
push 0xfffffffffffffffc
pop edx
mov ecx, edi
call fcn.00418622
pop ecx
mov ecx, edi
test eax, eax
jne 0x4a130b
push 0xfffffffffffffffe
push 0xfffffffffffffffc
pop edx
call fcn.004183e5
pop ecx
jmp 0x4a1310
call fcn.0041c002
push 1
or edx, 0xffffffff
mov ecx, edi
call fcn.004188dc
pop ecx
mov ecx, edi
test eax, eax
jne 0x4a12e4
push 3
pop edx
call fcn.0041bdf5
or edx, 0xffffffff
mov ecx, edi
call fcn.00419a01
mov dword [0x74cc00], eax
mov dword [0x74cc1c], edi
mov eax, dword [ebp - 0x24]
mov dword [0x74cc08], eax
call dword [sym.imp.KERNEL32.dll_FreeConsole]
call fcn.0049f557
push ebx
push 0x4a1814
push ebx
push 0x67
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
call fcn.0049f725
jmp 0x4a1383
push ebx
or edx, 0xffffffff
mov ecx, edi
call fcn.0041a1c6
push eax
push str.Error:__s
call fcn.00401109
add esp, 0xc
mov ecx, edi
call fcn.0045bb3a
mov edi, dword [ebp - 0x2c]
mov dword [edi], 2
mov ecx, edi
call fcn.0048549f
mov ecx, edi
call fcn.00487e4a
call dword [sym.imp.ole32.dll_CoUninitialize]
test dword [esi - 0x10], 0xfffffffc
jbe 0x49fff3
mov ecx, dword [esi + ebx*4]
call fcn.00484cd3
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x4a13b4
jmp 0x49fff3
push 1
push 0x49fafe
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov dword [ebp - 4], ebx
mov ecx, ebx
mov dword [ebp - 0x3c], ecx
cmp edi, 1
jle 0x4a1402
push 0x746090
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
mov ecx, ebx
push 0x20
pop edx
test eax, eax
cmove ecx, edx
mov dword [ebp - 0x3c], ecx
call fcn.004077ce
mov edx, eax
mov dword [0x74cc04], edx
mov ecx, dword [ebp - 0x34]
mov dword [edx + 0x10], ecx
mov eax, dword [ebp - 0x20]
mov dword [edx + 0x14], eax
test ecx, ecx
jne 0x4a1450
cmp edi, 1
jle 0x4a145a
push 0x746098
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
je 0x4a144a
push 0x74609c
push dword [esi + 4]
call fcn.005edb40
pop ecx
pop ecx
test eax, eax
jne 0x4a145a
mov edx, dword [0x74cc04]
mov dword [edx + 0xd68], 1
push esi
mov edx, edi
call fcn.0040ade6
pop ecx
mov eax, dword [0x74cc04]
mov edi, dword [eax + 0xd34]
mov dword [ebp - 0x44], edi
call fcn.0040b46f
mov dword [0x74cc04], ebx
mov dword [ebp - 4], 0xfffffffe
test dword [esi - 0x10], 0xfffffffc
jbe 0x4a149f
mov ecx, dword [esi + ebx*4]
call fcn.00484cd3
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x4a148c
mov ebx, edi
mov ecx, esi
call fcn.00484cd3
mov eax, ebx
jmp 0x49fffc