Function at 0x140092ebc
Capabilities:
Copy file
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x890
mov rax, qword [0x140271510]
xor rax, rsp
mov qword [rsp + 0x880], rax
mov rdi, rdx
mov esi, ecx
xor ebx, ebx
mov r12d, ebx
mov r15d, ebx
lea r13d, [rbx + 1]
cmp ecx, r13d
jle 0x140092f6f
lea rdx, str._info
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x140092f6f
lea r8, str.Jun_14_2019
lea rdx, str.15:18:03
lea rcx, str.Compiled_on:__s___s_n
call fcn.140001090
lea rdx, str.cefab43b99c5e409054e316b5ec3e31914911238
lea rcx, str.___Commit_Hash:__s_n
call fcn.140001090
lea rdx, str.2019_Jun_14_15:11:40_0700
lea rcx, str.___Commit_Date:__s_n
call fcn.140001090
xor ecx, ecx
call fcn.1400aec30
mov rdx, rax
lea rcx, str.Using__s_n
call fcn.140001090
xor eax, eax
jmp 0x140093ee8
cmp esi, 2
jle 0x140093005
lea rdx, str._faddr
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x140092fc4
mov qword [rsp + 0x38], rbx
mov rcx, qword [rdi + 0x10]
add rcx, 2
lea r8, [rsp + 0x38]
lea rdx, str._016llx
call fcn.1400084d4
mov r8, qword [rsp + 0x38]
call fcn.140078938
lea rdx, [0x140275180]
lea rcx, [0x1401e846c]
jmp 0x140092f63
cmp esi, 2
jle 0x140093005
lea rdx, str._fdelta
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x140093005
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x38]
lea rdx, str._lld
mov rcx, qword [rdi + 0x10]
call fcn.1400084d4
lea r8, [0x1400785cc]
sub r8, qword [rsp + 0x38]
jmp 0x140092faf
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.14006a5ec
cmp esi, 2
jle 0x140093062
lea rdx, str._exec
mov rcx, qword [rdi + 8]
call fcn.14017f7c0
test eax, eax
jne 0x140093062
cmp dword [rsp + 0x30], ebx
jne 0x140093062
or edx, 0xffffffff
mov rcx, qword [rdi + 0x10]
call fcn.14007d488
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14009304f
mov dword [rsp + 0x30], ebx
jmp 0x140093062
mov edx, 0x1000
mov rcx, qword [rsp + 0x38]
call fcn.140175a7c
mov dword [rsp + 0x30], eax
cmp esi, r13d
jle 0x1400930f5
lea rdx, str._nodeid
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x1400930f5
movups xmm0, xmmword [str.console.log_require__agentNodeId_____process.exit___]
movups xmmword [rsp + 0x520], xmm0
movups xmm1, xmmword [0x140254998]
movups xmmword [rsp + 0x530], xmm1
movups xmm0, xmmword [0x1402549a8]
movups xmmword [rsp + 0x540], xmm0
mov eax, dword [0x1402549b8]
mov dword [rsp + 0x550], eax
movzx eax, word [0x1402549bc]
mov word [rsp + 0x554], ax
mov al, byte [0x1402549be]
mov byte [rsp + 0x556], al
mov r14d, gethostname
mov edx, r14d
lea rcx, [rsp + 0x520]
call fcn.14007d488
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r14d
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rsp + 0x40], ebx
test esi, esi
jle 0x14009319b
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rdi + rax*8]
test rcx, rcx
je 0x140093188
mov edx, 0x103
call fcn.140175a7c
mov r8, rax
cmp rax, 7
jbe 0x140093160
movsxd rcx, dword [rsp + 0x40]
mov rdx, qword [rdi + rcx*8]
mov ecx, dword [rdx]
cmp ecx, dword [str._proxy:]
jne 0x140093160
movzx ecx, word [rdx + 4]
cmp cx, word [0x1402549c4]
jne 0x140093160
mov al, byte [rdx + 6]
cmp al, byte [0x1402549c6]
jne 0x140093160
lea r12, [rdx + 7]
jmp 0x140093188
cmp r8, 5
jb 0x140093188
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rdi + rax*8]
mov eax, dword [rcx]
cmp eax, dword [str._tag:]
jne 0x140093188
mov al, byte [rcx + 4]
cmp al, byte [0x1402549cc]
jne 0x140093188
lea r15, [rcx + 5]
mov eax, dword [rsp + 0x40]
add eax, r13d
mov dword [rsp + 0x40], eax
cmp eax, esi
jl 0x14009310e
cmp esi, r13d
jle 0x14009328a
lea rdx, str._kvm0
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x14009324b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 0x18]
call fcn.1400780d8
mov r14, rax
lea rax, [0x140092e44]
mov qword [r14], rax
mov dword [r14 + 0x10], ebx
mov r8d, 0x800
xor edx, edx
lea rcx, str.Shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test rax, rax
mov rsi, rbx
mov rdi, rax
je 0x140093221
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rsi, rax
jne 0x140093221
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, rbx
test rsi, rsi
je 0x140093238
mov ecx, 2
call rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14009323e
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
mov rcx, r14
call fcn.140009808
jmp 0x140092f68
cmp esi, r13d
jle 0x14009328a
lea rdx, str._kvm1
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x14009328a
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 0x18]
call fcn.1400780d8
mov r14, rax
lea rax, [0x140092e44]
mov qword [r14], rax
mov dword [r14 + 0x10], r13d
jmp 0x1400931dd
cmp qword [rsp + 0x38], rbx
jne 0x140093e16
test esi, esi
jle 0x1400932b0
lea rdx, str.__slave
mov rcx, qword [rdi]
call fcn.14017f0d0
test eax, eax
je 0x140093e16
cmp esi, r13d
jle 0x14009341b
lea rdx, [0x1401e9198]
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
je 0x140093e16
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
je 0x140093e16
lea rdx, str.__slave
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
je 0x140093e16
cmp esi, r13d
jle 0x14009341b
lea rdx, str.state
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x1400933a3
call fcn.140091e70
mov ebx, eax
cmp eax, r13d
jne 0x140093337
lea rcx, str.Stopped
jmp 0x140093397
cmp ebx, 2
jne 0x140093345
lea rcx, str.Start_Pending
jmp 0x140093397
cmp ebx, 3
jne 0x140093353
lea rcx, str.Stop_Pending
jmp 0x140093397
cmp ebx, 4
jne 0x140093361
lea rcx, str.Running
jmp 0x140093397
cmp ebx, 5
jne 0x14009336f
lea rcx, str.Continue_Pending
jmp 0x140093397
cmp ebx, 6
jne 0x14009337d
lea rcx, str.Pause_Pending
jmp 0x140093397
cmp ebx, 7
jne 0x14009338b
lea rcx, str.Paused
jmp 0x140093397
cmp ebx, 0x64
jne 0x14009339c
lea rcx, str.Not_installed
call fcn.140001090
mov eax, ebx
jmp 0x140093ee8
cmp esi, r13d
jle 0x14009341b
lea rdx, str._signcheck
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x14009341b
mov r14d, 0x104
mov r8d, r14d
lea rdx, [rsp + 0x770]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 5
jbe 0x140093421
call fcn.140076724
lea rcx, [rsp + 0x770]
call fcn.14000b8e8
mov edx, eax
lea rcx, [0x1401f09dc]
call fcn.140001090
mov eax, dword [0x140274e70]
sub eax, r13d
mov dword [0x140274e70], eax
test eax, eax
jg 0x140092f68
call fcn.1400afd20
jmp 0x140092f68
mov r14d, 0x104
cmp esi, r13d
jle 0x14009387a
lea rdx, str.start
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
je 0x140093452
lea rdx, str._start
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x14009348d
call fcn.140091f10
test eax, eax
jne 0x140093467
lea rcx, str.Failed_to_start_mesh_agent
jmp 0x140093d89
cmp eax, r13d
jne 0x140093478
lea rcx, str.Started_the_mesh_agent
jmp 0x140093d89
cmp eax, 2
jne 0x140093e0b
lea rcx, str.Mesh_agent_already_running
jmp 0x140093d89
cmp esi, r13d
jle 0x14009387a
lea rdx, str.stop
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
je 0x1400934be
lea rdx, str._stop
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x1400934e0
call fcn.140091fcc
cmp eax, r13d
jne 0x1400934d4
lea rcx, str.Stopped_mesh_agent
jmp 0x140093d89
lea rcx, str.Failed_to_stop_mesh_agent
jmp 0x140093d89
cmp esi, r13d
jle 0x14009387a
lea rdx, str.restart
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
je 0x140093511
lea rdx, str._restart
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x140093551
call fcn.140091fcc
call fcn.140091f10
test eax, eax
jne 0x14009352b
lea rcx, str.Failed_to_restart_mesh_agent
jmp 0x140093d89
cmp eax, r13d
jne 0x14009353c
lea rcx, str.Restarted_the_mesh_agent
jmp 0x140093d89
cmp eax, 2
jne 0x140093e0b
lea rcx, str.Mesh_agent_failed_to_stop
jmp 0x140093d89
cmp esi, r13d
jle 0x14009387a
lea rdx, str._install
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x1400935e3
call fcn.140091fcc
lea rcx, str.Mesh_Agent
call fcn.140091db8
lea rcx, [0x140254388]
call fcn.140091db8
call fcn.140091c2c
cmp eax, r13d
lea rcx, str.Mesh_agent_installed
je 0x1400935a3
lea rcx, str.Failed_to_install_mesh_agent
call fcn.140001090
mov r8d, r14d
lea rdx, [rsp + 0x560]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 5
jbe 0x140093e0b
lea rcx, [rsp + 0x560]
call fcn.140091258
lea rcx, [rsp + 0x560]
call fcn.140090dcc
jmp 0x140093e0b
cmp esi, r13d
jle 0x14009387a
lea rdx, str._remove
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
je 0x140093618
lea rdx, str._uninstall
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x1400936bb
call fcn.140091fcc
lea rcx, [0x140254388]
call fcn.140091db8
lea rcx, str.Mesh_Agent
call fcn.140091db8
mov dword [rsp + 0x40], eax
test eax, eax
jne 0x140093646
lea rcx, str.Failed_to_uninstall_mesh_agent
jmp 0x140093660
cmp eax, r13d
jne 0x140093654
lea rcx, str.Mesh_agent_uninstalled
jmp 0x140093660
cmp eax, 2
jne 0x140093665
lea rcx, str.Mesh_agent_still_running
call fcn.140001090
lea rdx, [0x1401e8f48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea rdx, [0x1401e8f48]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov r8d, r14d
lea rdx, [rsp + 0x560]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 5
jbe 0x140093e0b
lea rcx, [rsp + 0x560]
call fcn.140091258
jmp 0x140093e0b
cmp esi, r13d
jle 0x14009387a
mov rdx, qword [rdi + 8]
mov rax, qword [rdx]
cmp rax, qword [str._update:]
jne 0x140093703
jmp 0x1400936e5
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rdi + 8]
xor r8d, r8d
add rdx, 8
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x1400936d6
call fcn.140091f10
jmp 0x140093e0b
cmp esi, r13d
jle 0x14009387a
lea rdx, str._netinfo
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x14009373c
lea rcx, [rsp + 0x38]
call fcn.14000b5e0
test eax, eax
jle 0x140093e0b
mov rcx, qword [rsp + 0x38]
jmp 0x140093d89
cmp esi, r13d
jle 0x14009387a
lea rdx, str._fullinstall
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x140093795
test r15, r15
jne 0x140093763
mov rdi, rbx
jmp 0x140093771
mov rdx, r14
mov rcx, r15
call fcn.140175a7c
mov rdi, rax
test r12, r12
je 0x140093784
mov rdx, r14
mov rcx, r12
call fcn.140175a7c
mov rbx, rax
mov dword [rsp + 0x20], edi
mov r9, r15
mov r8d, ebx
mov rdx, r12
xor ecx, ecx
jmp 0x1400937c1
cmp esi, r13d
jle 0x14009387a
lea rdx, str._fulluninstall
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x1400937cb
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r13d
call fcn.14009217c
jmp 0x140093e0b
cmp esi, r13d
jle 0x14009387a
lea rdx, str._setfirewall
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x14009382c
mov r8d, r14d
lea rdx, [rsp + 0x560]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1400914dc
test eax, eax
jne 0x140093810
lea rcx, str.Must_run_as_administrator
jmp 0x140093d89
lea rcx, [rsp + 0x560]
call fcn.140091258
lea rcx, [rsp + 0x560]
call fcn.140090dcc
jmp 0x14009386e
cmp esi, r13d
jle 0x14009387a
lea rdx, str._clearfirewall
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x14009387a
mov r8d, r14d
lea rdx, [rsp + 0x560]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1400914dc
test eax, eax
je 0x140093804
lea rcx, [rsp + 0x560]
call fcn.140091258
lea rcx, str.Done
jmp 0x140093d89
cmp esi, 2
jne 0x140093ceb
lea rdx, str._nodeidhex
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x1400939c2
mov dword [rsp + 0x30], ebx
mov rdi, rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, r13d
xor r8d, r8d
lea rdx, [0x1401e8f48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400939a9
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.NodeId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14009399e
cmp dword [rsp + 0x30], ebx
jbe 0x14009399e
mov ecx, dword [rsp + 0x30]
call fcn.140176110
mov rdi, rax
test rax, rax
jne 0x14009395e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov edi, 0xfe
mov r9d, edi
mov ebx, 0x510
mov r8d, ebx
lea rdx, str.ServiceMain.c
xor ecx, ecx
call fcn.14007ddcc
mov r8d, ebx
lea rdx, str.ServiceMain.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.140001090
mov ecx, edi
call fcn.140170088
int3
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.NodeId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14009398f
cmp dword [rsp + 0x30], ebx
jne 0x14009399e
mov rcx, rdi
call fcn.140174cc8
mov rdi, rbx
mov dword [rsp + 0x30], ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rdi, rdi
mov rcx, rdi
jne 0x1400939b8
lea rcx, str.Not_defined__start_the_mesh_service_to_create_a_nodeid.
call fcn.140001090
jmp 0x140092f68
cmp esi, 2
jne 0x140093ceb
lea rdx, str._info
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x140093c4a
mov dword [rsp + 0x30], ebx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, r13d
xor r8d, r8d
lea rdx, [0x1401e8f48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140092f68
mov esi, 0x10000
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdi, [0x140276180]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.NodeId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
jne 0x140093a69
lea rcx, str.NodeId:_____none_
call fcn.140001090
jmp 0x140093a78
mov rdx, rdi
lea rcx, str.NodeId:_____s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MeshId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x140093ac3
mov rdx, rdi
lea rcx, str._r_nMeshId:_____s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.AgentHash
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x140093b0e
mov rdx, rdi
lea rcx, str._r_nAgentHash:__s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MeshServerId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x140093b59
mov rdx, rdi
lea rcx, str._r_nServerId:___s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MeshServerUrl
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x140093ba4
mov rdx, rdi
lea rcx, str._r_nServerUrl:__s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Proxy
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x140093bef
mov rdx, rdi
lea rcx, str._r_nProxy:______s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401e8474]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x140093c3a
mov rdx, rdi
lea rcx, str._r_nTag:________s
call fcn.140001090
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140092f68
cmp esi, 2
jne 0x140093ceb
lea rdx, str._resetnodeid
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x140093ceb
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, [0x1401e8f48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140093cdf
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 2]
xor r8d, r8d
lea rdx, str.ResetNodeId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140093c3a
lea rcx, str.NodeID_will_be_reset_next_time_the_Mesh_Agent_service_is_started.
call fcn.140001090
jmp 0x140093c3a
lea rcx, str.Error_writing_to_registry__try_running_as_administrator.
jmp 0x1400939b8
lea rcx, [0x140254388]
call fcn.140091db8
cmp esi, r13d
jle 0x140093d90
lea rdx, str._recovery
mov rcx, qword [rdi + 8]
call fcn.14017f7c0
test eax, eax
je 0x140093d90
mov dword [rsp + 0x20], r13d
mov r9d, 3
lea r8, [0x1401e93ec]
or edx, 0xffffffff
mov rcx, qword [rdi + 8]
call fcn.14007d0d0
test eax, eax
je 0x140093d82
mov edx, r13d
lea rcx, [0x140092e88]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop
xor ecx, ecx
call fcn.140005f18
mov qword [0x140274eb8], rax
mov dword [rax + 0x784], r13d
mov r8, rdi
mov edx, esi
call fcn.140007ba4
call fcn.14000801c
mov qword [0x140274eb8], rbx
jmp 0x140093e0b
lea rcx, str.Mesh_Agent_available_switches:_r_n__run_______________Start_as_a_console_agent._r_n__connect___________Start_as_a_temporary_console_agent._r_n__start_____________Start_the_service._r_n__restart___________Restart_the_service._r_n__stop______________Stop_the_service._r_n__state_____________Display_the_running_state_of_the_service._r_n___signcheck________Perform_self_check._r_n___install__________Install_the_service_from_this_location._r_n___uninstall________Remove_the_service_from_this_location._r_n___nodeidhex________Return_the_current_agent_identifier._r_n___fullinstall______Copy_agent_into_program_files__install_and_launch._r_n___fulluninstall____Stop_agent_and_clean_up_the_program_files_location._r_n___proxy:host:port__Specifiy_an_HTTPS_proxy__after__fullinstall_only_._r_n___tag:xxx__________Specifiy_a_agent_tag___after__fullinstall_only_._r_n___resetnodeid______Reset_the_NodeID_next_time_the_service_is_started.
call fcn.140001090
jmp 0x140093e0b
lea rax, str.Mesh_Agent_background_service
mov qword [rsp + 0x520], rax
lea rax, [0x140091aac]
mov qword [rsp + 0x528], rax
mov qword [rsp + 0x530], rbx
mov qword [rsp + 0x538], rbx
mov dword [0x140274f28], esi
mov qword [0x140274f20], rdi
lea rcx, [rsp + 0x520]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x140093e0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x427
jne 0x140093e0b
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov qword [rsp + 0x20], rbx
lea r9, [0x1400944cc]
xor r8d, r8d
lea edx, [r8 + 0x67]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DialogBoxParamA]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x140092f68
mov edx, r13d
lea rcx, [0x140092e88]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop
mov r14d, ebx
mov dword [rsp + 0x44], ebx
cmp esi, r13d
jle 0x140093e53
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
mov ecx, 0x20
test eax, eax
cmove r14d, ecx
mov dword [rsp + 0x44], r14d
mov ecx, r14d
call fcn.140005f18
mov qword [0x140274eb8], rax
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0x20], rdx
mov ecx, dword [rsp + 0x30]
mov dword [rax + 0x28], ecx
test rdx, rdx
jne 0x140093eab
cmp esi, r13d
jle 0x140093eb2
lea rdx, [0x1401e9198]
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
je 0x140093ea4
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.14017f0d0
test eax, eax
jne 0x140093eb2
mov rax, qword [0x140274eb8]
mov dword [rax + 0x784], r13d
mov r8, rdi
mov edx, esi
call fcn.140007ba4
mov rax, qword [0x140274eb8]
mov edi, dword [rax + 0x77c]
mov dword [rsp + 0x48], edi
call fcn.14000801c
mov qword [0x140274eb8], rbx
mov eax, edi
jmp 0x140093ee8
mov rcx, qword [rsp + 0x880]
xor rcx, rsp
call fcn.14016d990
lea r11, [rsp + 0x890]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret