Function at 0x1400a8b4c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc80
mov rax, qword [0x1402aaed0]
xor rax, rsp
mov qword [rsp + 0xc70], rax
mov r15, rdx
movsxd r14, ecx
mov dword [rsp + 0x40], r14d
lea eax, [r14 + 1]
mov dword [rsp + 0x48], eax
movsxd rdi, eax
shl rdi, 3
mov eax, 0xffffffff
cmp rdi, rax
jae 0x1400a8bb9
cmp rax, rdi
je 0x1400a8bb9
mov r12d, 0xffffffe7
cmp rdi, r12
jae 0x1400a8bbf
lea rcx, [rdi + 0x18]
call fcn.1401c2864
xor ebx, ebx
jmp 0x1400a8bc3
mov r12d, 0xffffffe7
xor ebx, ebx
mov eax, ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.14008ba98
mov rdi, rax
mov qword [rsp + 0x50], rax
mov rcx, r14
mov qword [rsp + 0x70], rcx
mov esi, 1
test r14d, r14d
jle 0x1400a8caa
sub rax, r15
mov rdi, rcx
or r13d, 0xffffffff
mov r14, rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9d, r13d
mov r8, qword [r15]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rsp + 0x44], eax
movsxd r13, eax
mov eax, 0xffffffff
cmp r13, rax
jae 0x1400a8c4b
cmp rax, r13
je 0x1400a8c4b
cmp r13, r12
jae 0x1400a8c4b
lea rcx, [r13 + 0x18]
call fcn.1401c2864
jmp 0x1400a8c4e
mov rax, rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
mov rcx, rax
call fcn.14008ba98
mov qword [r14 + r15], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov ecx, dword [rsp + 0x44]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
or r13d, 0xffffffff
mov r9d, r13d
mov r8, qword [r15]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add r15, 8
sub rdi, rsi
jne 0x1400a8bff
mov rdi, qword [rsp + 0x50]
mov r14d, dword [rsp + 0x40]
jmp 0x1400a8cae
or r13d, 0xffffffff
cmp r14d, esi
jle 0x1400a9136
lea rdx, str._finstall
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
je 0x1400a8d43
lea rdx, str._funinstall
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
je 0x1400a8d43
lea rdx, str._fulluninstall
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
je 0x1400a8d43
lea rdx, str._fullinstall
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
je 0x1400a8d43
lea rdx, str._install
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
je 0x1400a8d43
lea rdx, str._uninstall
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
je 0x1400a8d43
lea rdx, str._state
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
jne 0x1400a8d88
mov rax, qword [rdi + 8]
mov rcx, qword [rsp + 0x70]
mov qword [rdi + rcx*8], rax
mov ecx, 0x1c
call fcn.1401c2864
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
call fcn.14008ba98
mov qword [rdi + 8], rax
lea r8, [0x140246200]
mov rdx, qword [rax - 0x18]
mov rcx, rax
call fcn.1400010e4
mov r14d, dword [rsp + 0x48]
cmp r14d, esi
jle 0x1400a9136
lea rdx, str._licenses
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
jne 0x1400a908d
lea r12, str._n
mov rcx, r12
call fcn.140001090
lea rcx, str._MeshCentral_MeshAgent:_Copyright_2006___2020_Intel_Corporation_n
call fcn.140001090
lea rcx, str.________________________https:__github.com_Ylianst_MeshAgent__n
call fcn.140001090
lea r15, str._________________________________________________________________________________________n
mov rcx, r15
call fcn.140001090
lea rcx, str.___Licensed_under_the_Apache_License__Version_2.0__the__License____n
call fcn.140001090
lea rcx, str.___you_may_not_use_this_file_except_in_compliance_with_the_License._n
call fcn.140001090
lea rcx, str.___You_may_obtain_a_copy_of_the_License_at_n
call fcn.140001090
lea r14, str.____n
mov rcx, r14
call fcn.140001090
lea rcx, str.___http:__www.apache.org_licenses_LICENSE_2.0_n
call fcn.140001090
mov rcx, r14
call fcn.140001090
lea rcx, str.___Unless_required_by_applicable_law_or_agreed_to_in_writing__software_n
call fcn.140001090
lea rcx, str.___distributed_under_the_License_is_distributed_on_an__AS_IS__BASIS__n
call fcn.140001090
lea rcx, str.___WITHOUT_WARRANTIES_OR_CONDITIONS_OF_ANY_KIND__either_express_or_implied._n
call fcn.140001090
lea rcx, str.___See_the_License_for_the_specific_language_governing_permissions_and_n
call fcn.140001090
lea rcx, str.___limitations_under_the_License._n_n
call fcn.140001090
mov rcx, r12
call fcn.140001090
lea rcx, str._Duktape_Javascript_Engine:_Copyright__c__2013_2019_by_Duktape_authors__see_AUTHORS.rst__n
call fcn.140001090
lea rcx, str.________________________https:__github.com_svaarala_duktape__n
call fcn.140001090
lea rcx, str.________________________http:__opensource.org_licenses_MIT__n
call fcn.140001090
mov rcx, r15
call fcn.140001090
lea rcx, str.___Permission_is_hereby_granted__free_of_charge__to_any_person_obtaining_a_copy_n
call fcn.140001090
lea rcx, str.___of_this_software_and_associated_documentation_files_the__Software____to_deal_n
call fcn.140001090
lea rcx, str.___in_the_Software_without_restriction__including_without_limitation_the_rights_n
call fcn.140001090
lea rcx, str.___to_use__copy__modify__merge__publish__distribute__sublicense__and___or_sell_n
call fcn.140001090
lea rcx, str.___copies_of_the_Software__and_to_permit_persons_to_whom_the_Software_is_n
call fcn.140001090
lea rcx, str.___furnished_to_do_so__subject_to_the_following_conditions_:_n
call fcn.140001090
mov rcx, r14
call fcn.140001090
lea rcx, str.___The_above_copyright_notice_and_this_permission_notice_shall_be_included_in_n
call fcn.140001090
lea rcx, str.___all_copies_or_substantial_portions_of_the_Software._n
call fcn.140001090
mov rcx, r14
call fcn.140001090
lea rcx, str.___THE_SOFTWARE_IS_PROVIDED__AS_IS___WITHOUT_WARRANTY_OF_ANY_KIND__EXPRESS_OR_n
call fcn.140001090
lea rcx, str.___IMPLIED__INCLUDING_BUT_NOT_LIMITED_TO_THE_WARRANTIES_OF_MERCHANTABILITY__n
call fcn.140001090
lea rcx, str.___FITNESS_FOR_A_PARTICULAR_PURPOSE_AND_NONINFRINGEMENT.IN_NO_EVENT_SHALL_THE_n
call fcn.140001090
lea rcx, str.___AUTHORS_OR_COPYRIGHT_HOLDERS_BE_LIABLE_FOR_ANY_CLAIM__DAMAGES_OR_OTHER_n
call fcn.140001090
lea rcx, str.___LIABILITY__WHETHER_IN_AN_ACTION_OF_CONTRACT__TORT_OR_OTHERWISE__ARISING_FROM__n
call fcn.140001090
lea rcx, str.___OUT_OF_OR_IN_CONNECTION_WITH_THE_SOFTWARE_OR_THE_USE_OR_OTHER_DEALINGS_IN_n
call fcn.140001090
lea rcx, str.___THE_SOFTWARE._n
call fcn.140001090
mov rcx, r12
call fcn.140001090
lea rcx, str.ZLIB_Data_Compression_Library:_Copyright__c__1995_2017_Jean_loup_Gailly_and_Mark_Adler_n
call fcn.140001090
lea rcx, str._______________________________http:__www.zlib.net__n
call fcn.140001090
mov rcx, r15
call fcn.140001090
lea rcx, str.___This_software_is_provided_as_is__without_any_express_or_implied_n
call fcn.140001090
lea rcx, str.___warranty.In_no_event_will_the_authors_be_held_liable_for_any_damages_n
call fcn.140001090
lea rcx, str.___arising_from_the_use_of_this_software._n
call fcn.140001090
lea r14, [0x140245aa0]
mov rcx, r14
call fcn.140001090
lea rcx, str.___Permission_is_granted_to_anyone_to_use_this_software_for_any_purpose__n
call fcn.140001090
lea rcx, str.___including_commercial_applications__and_to_alter_it_and_redistribute_it_n
call fcn.140001090
lea rcx, str.___freely__subject_to_the_following_restrictions_:_n
call fcn.140001090
mov rcx, r14
call fcn.140001090
lea rcx, str.___1._The_origin_of_this_software_must_not_be_misrepresented__you_must_not_n
call fcn.140001090
lea rcx, str.______claim_that_you_wrote_the_original_software.If_you_use_this_software_n
call fcn.140001090
lea rcx, str.______in_a_product__an_acknowledgment_in_the_product_documentation_would_be_n
call fcn.140001090
lea rcx, str.______appreciated_but_is_not_required._n
call fcn.140001090
lea rcx, str.___2._Altered_source_versions_must_be_plainly_marked_as_such__and_must_not_be_n
call fcn.140001090
lea rcx, str.______misrepresented_as_being_the_original_software._n
call fcn.140001090
lea rcx, str.___3._This_notice_may_not_be_removed_or_altered_from_any_source_distribution._n
call fcn.140001090
mov rcx, r14
call fcn.140001090
lea rcx, str.___Jean___loup_Gailly________Mark_Adler_n
call fcn.140001090
lea rcx, str.___jloup_gzip.org____________madler_alumni.caltech.edu_n
call fcn.140001090
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400a907e
mov r14, rdi
mov rcx, qword [r14]
call fcn.14008bb80
add ebx, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400a9064
mov rcx, rdi
call fcn.14008bb80
xor eax, eax
jmp 0x1400aa37b
cmp r14d, esi
jle 0x1400a9136
lea rdx, str._info
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
jne 0x1400a9136
lea r8, str.Aug_12_2020
lea rdx, str.12:35:33
lea rcx, str.Compiled_on:__s___s_n
call fcn.140001090
lea rdx, str.376d51cb9e30c952a45d5c4aef56c6cf712f6476
lea rcx, str.___Commit_Hash:__s_n
call fcn.140001090
lea rdx, str.2020_Aug_12_12:33:58_0700
lea rcx, str.___Commit_Date:__s_n
call fcn.140001090
xor ecx, ecx
call fcn.1400c6690
mov rdx, rax
lea rcx, str.Using__s_n
call fcn.140001090
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400a907e
mov r14, rdi
mov rcx, qword [r14]
call fcn.14008bb80
add ebx, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400a9117
jmp 0x1400a907e
cmp r14d, 2
jle 0x1400a924f
lea rdx, str._faddr
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
jne 0x1400a91c1
mov qword [rsp + 0x50], rbx
mov rcx, qword [rdi + 0x10]
add rcx, 2
lea r8, [rsp + 0x50]
lea rdx, str._016llx
call fcn.14000bc84
mov r8, qword [rsp + 0x50]
call fcn.14008d158
lea rdx, [0x1402b2820]
lea rcx, [0x14024431c]
call fcn.140001090
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400a907e
mov r14, rdi
mov rcx, qword [r14]
call fcn.14008bb80
add ebx, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400a91a2
jmp 0x1400a907e
cmp r14d, 2
jle 0x1400a924f
lea rdx, str._fdelta
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
jne 0x1400a924f
mov qword [rsp + 0x50], rbx
lea r8, [rsp + 0x50]
lea rdx, str._lld
mov rcx, qword [rdi + 0x10]
call fcn.14000bc84
lea r8, [0x14008c1bc]
sub r8, qword [rsp + 0x50]
call fcn.14008d158
lea rdx, [0x1402b2820]
lea rcx, [0x14024431c]
call fcn.140001090
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400a907e
mov r14, rdi
mov rcx, qword [r14]
call fcn.14008bb80
add ebx, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400a9230
jmp 0x1400a907e
mov r8d, 0x104
lea rdx, [rsp + 0x850]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x208
lea rax, [rsp + 0xa60]
mov qword [rsp + 0x20], rax
mov r9d, r13d
lea r8, [rsp + 0x850]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0xa60]
call fcn.14007cae4
cmp r14d, 2
jle 0x1400a9306
lea rdx, str._exec
mov rcx, qword [rdi + 8]
call fcn.1401cd3e0
test eax, eax
jne 0x1400a9306
mov r12d, dword [rsp + 0x44]
test r12d, r12d
jne 0x1400a930b
mov edx, r13d
mov rcx, qword [rdi + 0x10]
call fcn.1400932b4
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x1400a92f2
mov r12d, ebx
jmp 0x1400a930b
mov edx, 0x1000
mov rcx, qword [rsp + 0x48]
call fcn.1401c21d0
mov r12, rax
jmp 0x1400a930b
mov r12d, dword [rsp + 0x44]
cmp r14d, 2
jle 0x1400a935b
lea rdx, str._b64exec
mov rcx, qword [rdi + 8]
call fcn.1401cd3e0
test eax, eax
jne 0x1400a935b
test r12d, r12d
jne 0x1400a935b
mov rcx, qword [rdi + 0x10]
mov r15d, 0x10000
test rcx, rcx
jne 0x1400a933e
mov rax, rbx
jmp 0x1400a9346
mov rdx, r15
call fcn.1401c21d0
lea r8, [rsp + 0x48]
mov edx, eax
mov rcx, qword [rdi + 0x10]
call fcn.1400917f8
mov r12d, eax
jmp 0x1400a9361
mov r15d, 0x10000
cmp r14d, esi
jle 0x1400a93ef
lea rdx, str._nodeid
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
jne 0x1400a93ef
movups xmm0, xmmword [str.console.log_require__agentNodeId_____process.exit___]
movups xmmword [rsp + 0x600], xmm0
movups xmm1, xmmword [0x140289958]
movups xmmword [rsp + 0x610], xmm1
movups xmm0, xmmword [0x140289968]
movups xmmword [rsp + 0x620], xmm0
mov eax, dword [0x140289978]
mov dword [rsp + 0x630], eax
movzx eax, word [0x14028997c]
mov word [rsp + 0x634], ax
mov al, byte [0x14028997e]
mov byte [rsp + 0x636], al
mov r12d, gethostname
mov edx, r12d
lea rcx, [rsp + 0x600]
call fcn.1400932b4
mov qword [rsp + 0x48], rax
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
cmp r14d, esi
jle 0x1400a967b
lea rdx, str._kvm0
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
jne 0x1400a9539
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 0x20]
call fcn.14008bc74
mov r12, rax
lea rax, [0x1400a8ad4]
mov qword [r12], rax
mov dword [r12 + 0x10], ebx
cmp r14d, 2
jle 0x1400a945c
lea rdx, str._coredump
mov rcx, qword [rdi + 0x10]
call fcn.1401ccec4
test eax, eax
mov eax, esi
je 0x1400a945e
mov eax, ebx
mov dword [r12 + 0x18], eax
cmp r14d, 2
jle 0x1400a947d
lea rdx, str._remotecursor
mov rcx, qword [rdi + 0x10]
call fcn.1401ccec4
test eax, eax
je 0x1400a9497
cmp r14d, 3
jle 0x1400a949d
lea rdx, str._remotecursor
mov rcx, qword [rdi + 0x18]
call fcn.1401ccec4
test eax, eax
jne 0x1400a949d
mov dword [0x1402ae368], esi
xor edx, edx
mov r8d, 0x800
lea rcx, str.Shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r14, rax
mov r15, rbx
test rax, rax
je 0x1400a94e1
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
jne 0x1400a94e1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r14, rbx
test r15, r15
je 0x1400a94f9
mov ecx, 2
call r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400a94ff
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
mov rcx, r12
call fcn.14000d768
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400a907e
mov r14, rdi
mov rcx, qword [r14]
call fcn.14008bb80
add ebx, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400a951a
jmp 0x1400a907e
cmp r14d, esi
jle 0x1400a967b
lea rdx, str._kvm1
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
jne 0x1400a967b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 0x20]
call fcn.14008bc74
mov r12, rax
lea rax, [0x1400a8ad4]
mov qword [r12], rax
mov dword [r12 + 0x10], esi
cmp r14d, 2
jle 0x1400a9599
lea rdx, str._coredump
mov rcx, qword [rdi + 0x10]
call fcn.1401ccec4
test eax, eax
mov eax, esi
je 0x1400a959b
mov eax, ebx
mov dword [r12 + 0x18], eax
cmp r14d, 2
jle 0x1400a95ba
lea rdx, str._remotecursor
mov rcx, qword [rdi + 0x10]
call fcn.1401ccec4
test eax, eax
je 0x1400a95d4
cmp r14d, 3
jle 0x1400a95da
lea rdx, str._remotecursor
mov rcx, qword [rdi + 0x18]
call fcn.1401ccec4
test eax, eax
jne 0x1400a95da
mov dword [0x1402ae368], esi
xor edx, edx
mov r8d, 0x800
lea rcx, str.Shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r14, rax
mov r15, rbx
test rax, rax
je 0x1400a961e
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
jne 0x1400a961e
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r14, rbx
test r15, r15
je 0x1400a9636
mov ecx, 2
call r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400a963c
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
mov rcx, r12
call fcn.14000d768
mov r15d, ebx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400aa361
mov r14, rdi
mov rcx, qword [r14]
call fcn.14008bb80
add r15d, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp r15d, eax
jl 0x1400a965a
jmp 0x1400aa361
cmp qword [rsp + 0x48], rbx
jne 0x1400aa274
test r14d, r14d
jle 0x1400a96a2
lea rdx, str.__slave
mov rcx, qword [rdi]
call fcn.1401ccec4
test eax, eax
je 0x1400aa274
cmp r14d, esi
jle 0x1400a9ab1
lea rdx, [0x140246200]
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
je 0x1400aa274
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
je 0x1400aa274
lea rdx, str.__slave
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
je 0x1400aa274
cmp r14d, esi
jle 0x1400a9ab1
lea rdx, str.state
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
jne 0x1400a97c6
call fcn.1400a88b4
mov r14d, eax
cmp eax, esi
jne 0x1400a9729
lea rcx, str.Stopped
jmp 0x1400a9790
cmp r14d, 2
jne 0x1400a9738
lea rcx, str.Start_Pending
jmp 0x1400a9790
cmp r14d, 3
jne 0x1400a9747
lea rcx, str.Stop_Pending
jmp 0x1400a9790
cmp r14d, 4
jne 0x1400a9756
lea rcx, str.Running
jmp 0x1400a9790
cmp r14d, 5
jne 0x1400a9765
lea rcx, str.Continue_Pending
jmp 0x1400a9790
cmp r14d, 6
jne 0x1400a9774
lea rcx, str.Pause_Pending
jmp 0x1400a9790
cmp r14d, 7
jne 0x1400a9783
lea rcx, str.Paused
jmp 0x1400a9790
cmp r14d, 0x64
jne 0x1400a9795
lea rcx, str.Not_installed
call fcn.140001090
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400a97be
mov r15, rdi
mov rcx, qword [r15]
call fcn.14008bb80
add ebx, esi
lea r15, [r15 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400a97a4
mov ebx, r14d
jmp 0x1400aa361
cmp r14d, esi
jle 0x1400a9ab1
lea rdx, str.start
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
je 0x1400a97f7
lea rdx, str._start
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
jne 0x1400a9831
call fcn.1400a8954
test eax, eax
jne 0x1400a980c
lea rcx, str.Failed_to_start_mesh_agent
jmp 0x1400aa1af
cmp eax, esi
jne 0x1400a981c
lea rcx, str.Started_the_mesh_agent
jmp 0x1400aa1af
cmp eax, 2
jne 0x1400aa23c
lea rcx, str.Mesh_agent_already_running
jmp 0x1400aa1af
cmp r14d, esi
jle 0x1400a9ab1
lea rdx, str.stop
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
je 0x1400a9862
lea rdx, str._stop
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
jne 0x1400a9883
call fcn.1400a8a10
cmp eax, esi
jne 0x1400a9877
lea rcx, str.Stopped_mesh_agent
jmp 0x1400aa1af
lea rcx, str.Failed_to_stop_mesh_agent
jmp 0x1400aa1af
cmp r14d, esi
jle 0x1400a9ab1
lea rdx, str.restart
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
je 0x1400a98b4
lea rdx, str._restart
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
jne 0x1400a98f3
call fcn.1400a8a10
call fcn.1400a8954
test eax, eax
jne 0x1400a98ce
lea rcx, str.Failed_to_restart_mesh_agent
jmp 0x1400aa1af
cmp eax, esi
jne 0x1400a98de
lea rcx, str.Restarted_the_mesh_agent
jmp 0x1400aa1af
cmp eax, 2
jne 0x1400aa23c
lea rcx, str.Mesh_agent_failed_to_stop
jmp 0x1400aa1af
cmp r14d, esi
jle 0x1400a9ab1
mov rax, qword [rdi + 8]
mov rcx, qword [rax]
cmp rcx, qword [str._update:]
jne 0x1400a99be
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov r12d, 0x200
mov ecx, r12d
call fcn.14008bc74
mov r15, rax
lea r8, str.require_agent_installer_.update___
mov edx, r12d
mov rcx, rax
call fcn.1400010e4
mov r12d, eax
xor ecx, ecx
call fcn.140007300
mov qword [0x1402ae550], rax
mov qword [rax + 0x20], r15
mov dword [rax + 0x28], r12d
mov r8, rdi
mov edx, r14d
call fcn.14000a978
mov rax, qword [0x1402ae550]
mov r15d, dword [rax + 0xb8c]
mov dword [rsp + 0x68], r15d
call fcn.14000aecc
mov qword [0x1402ae550], rbx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400aa35e
mov r14, rdi
mov rcx, qword [r14]
call fcn.14008bb80
add ebx, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400a9991
jmp 0x1400aa35e
cmp r14d, esi
jle 0x1400a9ab1
lea rdx, str._netinfo
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
jne 0x1400a99fc
lea rcx, [rsp + 0x70]
call fcn.14000f450
test eax, eax
jle 0x1400aa23c
mov rcx, qword [rsp + 0x70]
call fcn.1400a84ec
jmp 0x1400aa23c
cmp r14d, esi
jle 0x1400a9ab1
lea rdx, str._setfirewall
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
jne 0x1400a9a60
mov r8d, 0x104
lea rdx, [rsp + 0x640]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1400a8540
test eax, eax
jne 0x1400a9a44
lea rcx, str.Must_run_as_administrator
jmp 0x1400aa1af
lea rcx, [rsp + 0x640]
call fcn.1400a8268
lea rcx, [rsp + 0x640]
call fcn.1400a7ddc
jmp 0x1400a9aa5
cmp r14d, esi
jle 0x1400a9ab1
lea rdx, str._clearfirewall
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
jne 0x1400a9ab1
mov r8d, 0x104
lea rdx, [rsp + 0x640]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1400a8540
test eax, eax
je 0x1400a9a38
lea rcx, [rsp + 0x640]
call fcn.1400a8268
lea rcx, str.Done
jmp 0x1400aa1af
cmp r14d, 2
jne 0x1400a9fcc
lea rdx, str._nodeidhex
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
jne 0x1400a9c33
mov dword [rsp + 0x44], ebx
mov r14, rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
lea rdx, [0x140245d78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400a9be1
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.NodeId
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400a9bd6
cmp dword [rsp + 0x44], ebx
jbe 0x1400a9bd6
mov ecx, dword [rsp + 0x44]
call fcn.1401c2864
mov r14, rax
test rax, rax
jne 0x1400a9b96
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov edi, 0xfe
mov r9d, edi
mov ebx, 0x317
mov r8d, ebx
lea rdx, str.ServiceMain.c
xor ecx, ecx
call fcn.140093d88
mov r8d, ebx
lea rdx, str.ServiceMain.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.140001090
mov ecx, edi
call fcn.1401bbfb8
int3
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, str.NodeId
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400a9bc7
cmp dword [rsp + 0x44], ebx
jne 0x1400a9bd6
mov rcx, r14
call fcn.1401c141c
mov r14, rbx
mov dword [rsp + 0x44], ebx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x1400a9bf0
mov rcx, r14
call fcn.1400a84ec
jmp 0x1400a9bfc
lea rcx, str.Not_defined__start_the_mesh_service_to_create_a_nodeid.
call fcn.140001090
mov r15d, ebx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400aa361
mov r14, rdi
mov rcx, qword [r14]
call fcn.14008bb80
add r15d, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp r15d, eax
jl 0x1400a9c12
jmp 0x1400aa361
cmp r14d, 2
jne 0x1400a9fcc
lea rdx, str._info
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
jne 0x1400a9ef0
mov dword [rsp + 0x40], ebx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
lea rdx, [0x140245d78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400a9eb9
mov dword [rsp + 0x40], r15d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r14, [0x1402b3820]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, str.NodeId
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x40]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x40], ecx
test ecx, ecx
jne 0x1400a9cd7
lea rcx, str.NodeId:_____none_
call fcn.140001090
jmp 0x1400a9ce6
mov rdx, r14
lea rcx, str.NodeId:_____s
call fcn.140001090
mov dword [rsp + 0x40], r15d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MeshId
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x40]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x40], ecx
test ecx, ecx
je 0x1400a9d32
mov rdx, r14
lea rcx, str._r_nMeshId:_____s
call fcn.140001090
mov dword [rsp + 0x40], r15d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, str.AgentHash
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x40]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x40], ecx
test ecx, ecx
je 0x1400a9d7e
mov rdx, r14
lea rcx, str._r_nAgentHash:__s
call fcn.140001090
mov dword [rsp + 0x40], r15d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MeshServerId
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x40]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x40], ecx
test ecx, ecx
je 0x1400a9dca
mov rdx, r14
lea rcx, str._r_nServerId:___s
call fcn.140001090
mov dword [rsp + 0x40], r15d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MeshServerUrl
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x40]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x40], ecx
test ecx, ecx
je 0x1400a9e16
mov rdx, r14
lea rcx, str._r_nServerUrl:__s
call fcn.140001090
mov dword [rsp + 0x40], r15d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Proxy
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x40]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x40], ecx
test ecx, ecx
je 0x1400a9e62
mov rdx, r14
lea rcx, str._r_nProxy:______s
call fcn.140001090
mov dword [rsp + 0x40], r15d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140244b34]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x40]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x40], ecx
test ecx, ecx
je 0x1400a9eae
mov rdx, r14
lea rcx, str._r_nTag:________s
call fcn.140001090
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15d, ebx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400aa361
mov r14, rdi
mov rcx, qword [r14]
call fcn.14008bb80
add r15d, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp r15d, eax
jl 0x1400a9ecf
jmp 0x1400aa361
cmp r14d, 2
jne 0x1400a9fcc
lea rdx, str._resetnodeid
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
jne 0x1400a9fcc
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, [0x140245d78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400a9f89
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 2]
xor r8d, r8d
lea rdx, str.ResetNodeId
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1400a9f7c
lea rcx, str.NodeID_will_be_reset_next_time_the_Mesh_Agent_service_is_started.
call fcn.140001090
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400a9f95
lea rcx, str.Error_writing_to_registry__try_running_as_administrator.
call fcn.140001090
mov r15d, ebx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400aa361
mov r14, rdi
mov rcx, qword [r14]
call fcn.14008bb80
add r15d, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp r15d, eax
jl 0x1400a9fab
jmp 0x1400aa361
lea rax, str.Mesh_Agent_background_service
mov qword [rsp + 0x600], rax
lea rax, [0x1400a8734]
mov qword [rsp + 0x608], rax
mov qword [rsp + 0x610], rbx
mov qword [rsp + 0x618], rbx
mov dword [0x1402ae5c0], r14d
mov qword [0x1402ae5b8], rdi
lea rcx, [rsp + 0x600]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x1400aa23c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x427
jne 0x1400aa23c
cmp r14d, 2
jl 0x1400aa0c7
mov dword [rsp + 0x20], esi
mov r9d, 3
lea r8, [0x140246504]
mov edx, r13d
mov rcx, qword [rdi + 8]
call fcn.140092ef8
test eax, eax
jne 0x1400aa079
mov dword [rsp + 0x20], esi
lea r9d, [rax + 4]
lea r8, str..zip
mov edx, r13d
mov rcx, qword [rdi + 8]
call fcn.140092ef8
test eax, eax
je 0x1400aa0c7
mov edx, esi
lea rcx, [0x1400a8b18]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop
xor ecx, ecx
call fcn.140007300
mov qword [0x1402ae550], rax
mov dword [rax + 0xb9c], esi
mov r8, rdi
mov edx, r14d
call fcn.14000a978
call fcn.14000aecc
mov qword [0x1402ae550], rbx
jmp 0x1400aa23c
cmp r14d, esi
je 0x1400aa1b9
lea rcx, str.Mesh_Agent_available_switches:_r_n
call fcn.140001090
lea rcx, str.__run_______________Start_as_a_console_agent._r_n
call fcn.140001090
lea rcx, str.__connect___________Start_as_a_temporary_console_agent._r_n
call fcn.140001090
lea rcx, str.__start_____________Start_the_service._r_n
call fcn.140001090
lea rcx, str.__restart___________Restart_the_service._r_n
call fcn.140001090
lea rcx, str.__stop______________Stop_the_service._r_n
call fcn.140001090
lea rcx, str.__state_____________Display_the_running_state_of_the_service._r_n
call fcn.140001090
lea rcx, str.___signcheck________Perform_self___check._r_n
call fcn.140001090
lea rcx, str.___install__________Install_the_service_from_this_location._r_n
call fcn.140001090
lea rcx, str.___uninstall________Remove_the_service_from_this_location._r_n
call fcn.140001090
lea rcx, str.___nodeidhex________Return_the_current_agent_identifier._r_n
call fcn.140001090
lea rcx, str.___resetnodeid______Reset_the_NodeID_next_time_the_service_is_started._r_n
call fcn.140001090
lea rcx, str.___fulluninstall____Stop_agent_and_clean_up_the_program_files_location._r_n
call fcn.140001090
lea rcx, str.___fullinstall______Copy_agent_into_program_files__install_and_launch._r_n
call fcn.140001090
lea rcx, [0x1402528bc]
call fcn.140001090
lea rcx, str.____________________The_following_switches_can_be_specified_after__fullinstall:_r_n
call fcn.140001090
lea rcx, [0x1402528bc]
call fcn.140001090
lea rcx, str._______WebProxy_http:__proxyhost:port_______Specify_an_HTTPS_proxy._r_n
call fcn.140001090
lea rcx, str._______agentName_alternate_name_____________Specify_an_alternate_name_to_be_provided_by_the_agent._r_n
call fcn.140001090
jmp 0x1400aa23c
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor edx, edx
mov r8d, 0x800
lea rcx, str.Shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r14, rax
mov r15, rbx
test rax, rax
je 0x1400aa203
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
jne 0x1400aa203
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r14, rbx
test r15, r15
je 0x1400aa21b
mov ecx, 2
call r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400aa221
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
mov qword [rsp + 0x20], rbx
lea r9, [0x1400aa700]
xor r8d, r8d
lea edx, [r8 + 0x67]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DialogBoxParamA]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400a907e
mov r14, rdi
mov rcx, qword [r14]
call fcn.14008bb80
add ebx, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400aa255
jmp 0x1400a907e
mov edx, esi
lea rcx, [0x1400a8b18]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop
mov r15d, ebx
mov dword [rsp + 0x64], ebx
cmp r14d, esi
jle 0x1400aa2b0
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
mov ecx, 0x20
test eax, eax
cmove r15d, ecx
mov dword [rsp + 0x64], r15d
mov ecx, r15d
call fcn.140007300
mov qword [0x1402ae550], rax
mov rcx, qword [rsp + 0x48]
mov qword [rax + 0x20], rcx
mov dword [rax + 0x28], r12d
test rcx, rcx
jne 0x1400aa305
cmp r14d, esi
jle 0x1400aa30b
lea rdx, [0x140246200]
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
je 0x1400aa2fe
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.1401ccec4
test eax, eax
jne 0x1400aa30b
mov rax, qword [0x1402ae550]
mov dword [rax + 0xb9c], esi
mov r8, rdi
mov edx, r14d
call fcn.14000a978
mov rax, qword [0x1402ae550]
mov r15d, dword [rax + 0xb8c]
mov dword [rsp + 0x68], r15d
call fcn.14000aecc
mov qword [0x1402ae550], rbx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400aa35e
mov r14, rdi
mov rcx, qword [r14]
call fcn.14008bb80
add ebx, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400aa344
mov ebx, r15d
mov rcx, rdi
call fcn.14008bb80
mov eax, ebx
jmp 0x1400aa37b
mov rcx, qword [rsp + 0xc70]
xor rcx, rsp
call fcn.1401b98c0
lea r11, [rsp + 0xc80]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret