Function at 0x4c9b70
Capabilities:
Copy file
Create directory
Delete directory
Delete registry key
Get common file path
Query service status
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5b4
mov eax, dword [0x6019e4]
xor eax, esp
mov dword [esp + 0x5b0], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov ebx, ecx
mov dword [esp + 0x1c], edx
xor edi, edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edi
call fcn.004c8fd0
test eax, eax
jne 0x4c9bcf
push str.Requires_administrator_permissions._r_n
call fcn.004010e0
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.005852a8
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x4c9bda
push str.Performing_uninstall..._r_n
jmp 0x4c9bdf
push str.Performing_install..._r_n
call fcn.004010e0
add esp, 4
call fcn.004c9a10
xor ebx, ebx
nop
push 0x64
inc ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x4c9c5c
push 0x10004
push str.Mesh_Agent
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [esp + 0x20], eax
test eax, eax
je 0x4c9c43
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push dword [esp + 0x20]
test eax, eax
cmovne esi, dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4c9c48
mov esi, 0x64
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp esi, 3
jne 0x4c9c5c
cmp ebx, 0x190
jl 0x4c9bf0
mov ecx, str.Mesh_Agent
call fcn.004c9870
mov ecx, 0x62837c
call fcn.004c9870
push 0x104
lea eax, [esp + 0x27c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, eax
lea eax, [esp + 0x149]
push eax
push 0
push 0
push 0x8026
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp eax, 1
je 0x4c9cf4
lea eax, [esp + 0x149]
mov byte [esp + 0x148], 0x22
push 0x12c
push eax
call fcn.0058d536
mov ebx, eax
add esp, 8
cmp ebx, 0x104
ja 0x4c9ceb
push 0x26
mov edx, 0x12c
lea ecx, [esp + 0x14d]
push str.Mesh_AgentMeshAgent.exe___uninstall
sub edx, ebx
add ecx, ebx
call fcn.00401000
add esp, 8
add ebx, 0x19
mov dword [esp + 0x14], ebx
jmp 0x4c9cf6
xor ebx, ebx
cmp dword [esp + 0x10], 0
je 0x4c9e05
cmp ebx, edi
jne 0x4c9e05
mov esi, ebx
lea ecx, [esp + 0x278]
lea edx, [esp + 0x149]
sub esi, 4
jb 0x4c9d31
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4c9d36
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4c9d20
cmp esi, 0xfffffffc
je 0x4c9d6a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4c9d63
cmp esi, 0xfffffffd
je 0x4c9d6a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4c9d63
cmp esi, 0xfffffffe
je 0x4c9d6a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4c9d63
cmp esi, 0xffffffff
je 0x4c9d6a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x4c9d6a
sbb eax, eax
or eax, 1
jmp 0x4c9d6c
xor eax, eax
test eax, eax
jne 0x4c9e05
lea eax, [esp + 0x488]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, 0x12c
lea esi, [esp + 0x488]
sub edi, eax
add esi, eax
push 0xf
push 0x6286c4
mov edx, edi
mov ecx, esi
call fcn.00401000
lea eax, [esp + 0x490]
push eax
call fcn.00593549
add esp, 0xc
lea eax, [esp + 0x488]
push 0
push eax
lea eax, [esp + 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x1e
push str.MeshAgent.exe__fulluninstall
mov edx, edi
mov ecx, esi
call fcn.00401000
add esp, 8
lea ecx, [esp + 0x488]
xor edx, edx
call fcn.004c9ab0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.005852a8
mov esp, ebp
pop ebp
ret
mov edx, 1
lea ecx, [esp + 0x148]
call fcn.004c9ab0
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x6286f4
push reloc.WS2_32.dll_bind
call esi
push 0x628714
push reloc.WS2_32.dll_accept
call esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallMeshCentralAgent
push reloc.WS2_32.dll_bind
call esi
cmp dword [esp + 0x10], 0
jne 0x4c9eb7
cmp ebx, edi
jne 0x4c9eb7
mov esi, ebx
lea ecx, [esp + 0x278]
lea edx, [esp + 0x149]
sub esi, 4
jb 0x4c9e71
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4c9e7a
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4c9e60
cmp esi, 0xfffffffc
je 0x4ca696
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4c9eb7
cmp esi, 0xfffffffd
je 0x4ca696
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4c9eb7
cmp esi, 0xfffffffe
je 0x4ca696
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4c9eb7
cmp esi, 0xffffffff
je 0x4ca696
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x4ca696
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov byte [esp + ebx + 0x149], 0
push 0x64
call edi
lea eax, [esp + 0x149]
inc esi
push eax
call fcn.00593549
add esp, 4
test eax, eax
je 0x4c9eed
cmp eax, 0xffffffff
je 0x4c9eed
cmp esi, 0x190
jl 0x4c9ec7
lea eax, [esp + 0x149]
push 0x12c
push eax
call fcn.0058d536
mov esi, eax
add esp, 8
lea ecx, [esi - 4]
cmp ecx, 0xff
ja 0x4c9df0
lea eax, [esp + 0x149]
mov edx, 0x104
push esi
push eax
lea ecx, [esp + 0x48]
call fcn.00401000
mov ebx, 0x101
lea ecx, [esp + esi + 0x45]
push 4
mov edx, ebx
push 0x628734
sub edx, esi
call fcn.00401000
add esp, 0x10
cmp esi, 0x104
jae 0x4ca709
lea eax, [esp + 0x40]
mov byte [esp + esi + 0x40], 0
push eax
call fcn.00593549
add esp, 4
lea eax, [esp + 0x149]
push 0x12c
push eax
call fcn.0058d536
mov esi, eax
add esp, 8
lea ecx, [esi - 4]
cmp ecx, 0xff
ja 0x4c9df0
lea eax, [esp + 0x149]
push esi
push eax
lea edx, [ebx + 3]
lea ecx, [esp + 0x48]
call fcn.00401000
push 5
mov edx, ebx
lea ecx, [esp + esi + 0x49]
push str.mshx
sub edx, esi
call fcn.00401000
inc esi
add esp, 0x10
cmp esi, 0x104
jae 0x4ca709
lea eax, [esp + 0x40]
mov byte [esp + esi + 0x40], 0
push eax
call fcn.00593549
add esp, 4
lea eax, [esp + 0x149]
push 0x12c
push eax
call fcn.0058d536
mov esi, eax
add esp, 8
lea ecx, [esi - 4]
cmp ecx, 0xfd
ja 0x4c9df0
lea eax, [esp + 0x149]
push esi
push eax
lea edx, [ebx + 3]
lea ecx, [esp + 0x48]
call fcn.00401000
push 6
mov edx, ebx
lea ecx, [esp + esi + 0x49]
push 0x628740
sub edx, esi
call fcn.00401000
add esi, 2
add esp, 0x10
cmp esi, 0x104
jae 0x4ca709
lea eax, [esp + 0x40]
mov byte [esp + esi + 0x40], 0
push eax
call fcn.00593549
add esp, 4
lea eax, [esp + 0x149]
push 0x12c
push eax
call fcn.0058d536
mov esi, eax
add esp, 8
lea ecx, [esi - 4]
cmp ecx, 0xff
ja 0x4c9df0
lea eax, [esp + 0x149]
push esi
push eax
lea edx, [ebx + 3]
lea ecx, [esp + 0x48]
call fcn.00401000
push 4
mov edx, ebx
lea ecx, [esp + esi + 0x49]
push 0x628748
sub edx, esi
call fcn.00401000
add esp, 0x10
cmp esi, 0x104
jae 0x4ca709
lea eax, [esp + 0x40]
mov byte [esp + esi + 0x40], 0
push eax
call fcn.00593549
add esp, 4
lea eax, [esp + 0x149]
push 0x12c
push eax
call fcn.0058d536
mov esi, eax
add esp, 8
lea ecx, [esi - 4]
cmp ecx, 0xff
ja 0x4c9df0
lea eax, [esp + 0x149]
push esi
push eax
lea edx, [ebx + 3]
lea ecx, [esp + 0x48]
call fcn.00401000
push 4
mov edx, ebx
lea ecx, [esp + esi + 0x49]
push 0x62874c
sub edx, esi
call fcn.00401000
add esp, 0x10
cmp esi, 0x104
jae 0x4ca709
lea eax, [esp + 0x40]
mov byte [esp + esi + 0x40], 0
push eax
call fcn.00593549
add esp, 4
lea eax, [esp + 0x149]
push 0x12c
push eax
call fcn.0058d536
mov esi, eax
add esp, 8
lea ecx, [esi - 4]
cmp ecx, 0xfc
ja 0x4c9df0
lea eax, [esp + 0x149]
push esi
push eax
lea edx, [ebx + 3]
lea ecx, [esp + 0x48]
call fcn.00401000
push 3
mov edx, ebx
lea ecx, [esp + esi + 0x49]
push 0x628750
sub edx, esi
call fcn.00401000
add esp, 0x10
cmp esi, 0x104
jae 0x4ca709
lea eax, [esp + 0x40]
mov byte [esp + esi + 0x40], 0
push eax
call fcn.00593549
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x14d]
add esp, 4
mov byte [esp + edi + 0x13b], 0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
cmp dword [esp + 0x10], 0
jne 0x4c9df0
push 0
lea eax, [esp + 0x14d]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4ca224
call esi
cmp eax, 5
jne 0x4ca224
call esi
push eax
push 0
push 0x2ec
mov edx, 0x628754
mov ecx, 0x628764
call fcn.004b4f80
add esp, 0xc
call esi
push eax
push str.Access_denied__1_
push 0x62878c
call fcn.004010e0
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.005852a8
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [esp + 0x149]
push 1
push eax
lea eax, [esp + 0x280]
mov byte [esp + edi + 0x143], 0x5c
push eax
xor edi, edi
call ebx
test eax, eax
jne 0x4ca28a
nop dword [eax]
call esi
cmp eax, 5
je 0x4ca43a
mov eax, edi
inc edi
cmp eax, 5
jg 0x4ca3f4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
lea eax, [esp + 0x14d]
push eax
lea eax, [esp + 0x280]
push eax
call ebx
test eax, eax
je 0x4ca250
lea eax, [esp + 0x278]
push 0x104
push eax
call fcn.0058d536
mov esi, eax
add esp, 8
cmp esi, 4
jl 0x4c9df0
lea eax, [esp + 0x278]
mov edx, 0x104
push esi
push eax
lea ecx, [esp + 0x388]
call fcn.00401000
mov edi, 0x101
lea ecx, [esp + esi + 0x385]
push 4
mov edx, edi
push 0x628850
sub edx, esi
call fcn.00401000
lea eax, [esp + 0x159]
push 0x12c
push eax
call fcn.0058d536
mov esi, eax
add esp, 0x18
lea ecx, [esi - 4]
cmp ecx, 0xff
ja 0x4c9df0
lea eax, [esp + 0x149]
push esi
push eax
lea edx, [edi + 3]
lea ecx, [esp + 0x48]
call fcn.00401000
push 4
mov edx, edi
lea ecx, [esp + esi + 0x49]
push 0x628854
sub edx, esi
call fcn.00401000
add esp, 0x10
lea eax, [esp + 0x40]
push 1
push eax
lea eax, [esp + 0x388]
push eax
call ebx
cmp dword [esp + 0x18], 0
je 0x4ca489
lea eax, [esp + 0x149]
mov dword [esp + 0x10], 0
push 0x12c
push eax
call fcn.0058d536
mov esi, eax
add esp, 8
lea ecx, [esi - 4]
cmp ecx, 0xff
ja 0x4c9df0
lea eax, [esp + 0x149]
push esi
push eax
lea edx, [edi + 3]
lea ecx, [esp + 0x48]
call fcn.00401000
push 4
mov edx, edi
lea ecx, [esp + esi + 0x49]
push 0x628858
sub edx, esi
call fcn.00401000
mov esi, dword [ebp + 0x10]
lea eax, [esp + 0x50]
add esp, 0x10
test esi, esi
jle 0x4ca480
push 0x62885c
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0058c7cb
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x4ca489
push eax
push esi
push 1
push dword [esp + 0x24]
call fcn.0058c4f0
push dword [esp + 0x20]
call fcn.00588cf7
add esp, 0x14
jmp 0x4ca489
call esi
push eax
push 0
push 0x2f4
mov edx, 0x6287ec
mov ecx, 0x6287fc
call fcn.004b4f80
add esp, 0xc
call esi
push eax
push str.Error_copying_executable_file
push str.ILIBMSG:__s___d_._r_n
call fcn.004010e0
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.005852a8
mov esp, ebp
pop ebp
ret
call esi
push eax
push 0
push 0x2f3
mov edx, 0x6287a0
mov ecx, 0x6287b0
call fcn.004b4f80
add esp, 0xc
call esi
push eax
push str.Access_denied__2_
push 0x6287d8
call fcn.004010e0
mov ecx, dword [esp + 0x5c8]
add esp, 0xc
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005852a8
mov esp, ebp
pop ebp
ret
push eax
call fcn.00593549
add esp, 4
lea eax, [esp + 0x278]
push 0x104
push eax
call fcn.0058d536
mov esi, eax
add esp, 8
cmp esi, 4
jl 0x4c9df0
lea eax, [esp + 0x278]
mov edx, 0x104
push esi
push eax
lea ecx, [esp + 0x388]
call fcn.00401000
push 6
mov edx, edi
lea ecx, [esp + esi + 0x389]
push 0x628860
sub edx, esi
call fcn.00401000
lea eax, [esp + 0x159]
push 0x12c
push eax
call fcn.0058d536
mov esi, eax
add esp, 0x18
lea ecx, [esi - 4]
cmp ecx, 0xff
ja 0x4c9df0
lea eax, [esp + 0x149]
mov edx, 0x104
push esi
push eax
lea ecx, [esp + 0x48]
call fcn.00401000
push 6
sub edi, esi
lea ecx, [esp + esi + 0x49]
push 0x628868
mov edx, edi
call fcn.00401000
mov edi, dword [esp + 0x2c]
add esp, 0x10
test edi, edi
je 0x4ca583
mov esi, dword [ebp + 8]
test esi, esi
jle 0x4ca583
push 0x628870
lea eax, [esp + 0x44]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0058c7cb
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x4ca692
push eax
push esi
push 1
push edi
call fcn.0058c4f0
push dword [esp + 0x20]
call fcn.00588cf7
add esp, 0x14
jmp 0x4ca692
push 1
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x388]
push eax
call ebx
test eax, eax
jne 0x4ca692
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
test eax, eax
je 0x4ca692
mov eax, dword [esp + 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
test eax, eax
je 0x4ca67c
push 0x7d0
push eax
push 0xfff
lea eax, [esp + 0x28]
mov dword [esp + 0x1c], 0
push 0x62c420
push eax
call fcn.005928c8
add esp, 0x14
test eax, eax
jne 0x4ca676
push 0x628874
push 0x62c420
call fcn.00586a60
mov esi, eax
add esp, 8
test esi, esi
je 0x4ca620
push 0x62887c
push esi
call fcn.00586a60
add esp, 8
add esi, 6
test eax, eax
je 0x4ca625
mov byte [eax], 0
jmp 0x4ca625
mov esi, 0x62c420
push 0x628880
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0058c7cb
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x4ca676
test esi, esi
jne 0x4ca64c
xor ecx, ecx
jmp 0x4ca660
push 0x1000
push esi
call fcn.0058d536
mov ecx, eax
add esp, 8
mov eax, dword [esp + 0x10]
push eax
push ecx
push 1
push esi
call fcn.0058c4f0
push dword [esp + 0x20]
call fcn.00588cf7
add esp, 0x14
push dword [esp + 0x2c]
call edi
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4ca687
push eax
call edi
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4ca692
push eax
call edi
mov ebx, dword [esp + 0x14]
call fcn.004c91a0
movq xmm0, qword [str.___install]
lea ecx, [esp + 0x148]
mov ax, word [0x62888c]
mov edx, 1
movq qword [esp + ebx + 0x149], xmm0
mov word [esp + ebx + 0x151], ax
movzx eax, byte [0x62888e]
mov byte [esp + ebx + 0x153], al
call fcn.004c9ab0
movq xmm0, qword [str.___start]
lea ecx, [esp + 0x148]
movzx eax, byte [0x628898]
mov edx, 1
movq qword [esp + ebx + 0x149], xmm0
mov byte [esp + ebx + 0x151], al
jmp 0x4c9deb
call fcn.005853dc
int3