Function at 0x4ca780
Capabilities:
Copy file
Delete registry key
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x6e0]
sub esp, 0x6e0
push 0xfffffffffffffffe
push 0x5fcc10
push 0x587990
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x6019e4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x6dc], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0x6ec]
mov dword [ebp - 0x2c], 0
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov edi, dword [ebp + 0x6e8]
cmp edi, 1
jle 0x4ca81f
push 0x62889c
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4ca81f
push str.Feb_22_2019
push str.17:19:36
push str.Compiled_on:__s___s_n
call fcn.004010e0
push ebx
call fcn.004e6f70
push eax
push str.Using__s_n
call fcn.004010e0
add esp, 0x18
jmp 0x4ca870
cmp edi, 2
jle 0x4ca8de
push str._faddr
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4ca895
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x24]
push eax
push 0x6288e8
mov eax, dword [esi + 8]
add eax, 2
push eax
call fcn.00409190
push 0
push dword [ebp - 0x24]
call fcn.004af950
push 0x62c420
push 0x6288ec
call fcn.004010e0
add esp, 0x1c
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x6dc]
xor ecx, ebp
call fcn.005852a8
lea esp, [ebp + 0x6e0]
pop ebp
ret
cmp edi, 2
jle 0x4ca8de
push str._fdelta
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4ca8de
xorps xmm0, xmm0
movlpd qword [ebp - 0x30], xmm0
lea eax, [ebp - 0x30]
push eax
push str._lld
push dword [esi + 8]
call fcn.00409190
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.004af920
push 0x62c420
push 0x628900
jmp 0x4ca868
push 0x104
lea eax, [ebp + 0x3d0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x1c]
lea ecx, [ebp + 0x3d0]
call fcn.0049abf0
add esp, 4
cmp edi, 2
jle 0x4ca97f
mov ecx, str._exec
mov eax, dword [esi + 4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4ca934
test dl, dl
je 0x4ca930
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4ca934
add eax, 2
add ecx, 2
test dl, dl
jne 0x4ca914
xor eax, eax
jmp 0x4ca939
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4ca97f
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x4ca975
or edx, 0xffffffff
mov ecx, dword [esi + 8]
call fcn.004b46d0
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jne 0x4ca960
mov dword [ebp - 0x24], eax
jmp 0x4ca98b
push 0x1000
push ebx
call fcn.0058d536
add esp, 8
mov dword [ebp - 0x24], eax
xor ebx, ebx
jmp 0x4ca98b
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
xor ebx, ebx
jmp 0x4ca98b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
xor ecx, ecx
mov dword [ebp - 0x28], ecx
test edi, edi
jle 0x4caa12
nop
mov eax, dword [esi + ecx*4]
test eax, eax
je 0x4caa0a
push 0x103
push eax
call fcn.0058d536
add esp, 8
mov ebx, eax
mov ecx, dword [ebp - 0x28]
cmp ebx, 7
jbe 0x4caa7f
mov edx, dword [esi + ecx*4]
mov eax, dword [edx]
cmp eax, dword [str._proxy:]
jne 0x4caa7f
movzx eax, word [edx + 4]
mov edi, str._proxy:
cmp ax, word [edi + 4]
mov edi, dword [ebp + 0x6e8]
jne 0x4caa7f
movzx eax, byte [edx + 6]
mov edi, str._proxy:
cmp al, byte [edi + 6]
mov edi, dword [ebp + 0x6e8]
jne 0x4caa7f
lea eax, [edx + 7]
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, edi
jl 0x4ca9a0
cmp edi, 1
jle 0x4cab25
push str._kvm0
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4caad4
push 0xc
call fcn.0058db11
add esp, 4
test eax, eax
jne 0x4caaae
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x624148
xor ecx, ecx
call fcn.004b4f80
push 0x4c4
push 0x624164
push 0x624180
call fcn.004010e0
add esp, 0x18
push 0xfe
call fcn.005885bd
cmp ebx, 5
jb 0x4caa07
mov edx, dword [esi + ecx*4]
mov ebx, str._tag:
mov eax, dword [edx]
cmp eax, dword [ebx]
jne 0x4caa07
movzx eax, byte [edx + 4]
cmp al, byte [ebx + 4]
jne 0x4caa07
lea ebx, [edx + 5]
mov dword [ebp - 0x20], ebx
jmp 0x4caa0a
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [eax], 0x4ca710
mov dword [eax + 8], 0
push eax
call fcn.0040a2c0
jmp 0x4ca870
cmp edi, 1
jle 0x4cab25
push str._kvm1
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4cab25
push 0xc
call fcn.0058db11
add esp, 4
test eax, eax
je 0x4caa41
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [eax], 0x4ca710
mov dword [eax + 8], 1
push eax
call fcn.0040a2c0
jmp 0x4ca870
cmp dword [ebp - 0x1c], 0
jne 0x4cb6ee
test edi, edi
jle 0x4cab4a
push 0x62892c
push dword [esi]
call fcn.00594adb
add esp, 8
test eax, eax
je 0x4cb6ee
cmp edi, 1
jle 0x4cb225
push 0x628934
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
je 0x4cb6ee
push 0x628938
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
je 0x4cb6ee
push str.__slave
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
je 0x4cb6ee
cmp edi, 1
jle 0x4cb225
push str.state
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4cac8b
call fcn.004c9900
mov esi, eax
cmp esi, 1
jne 0x4cabdc
push 0x628964
call fcn.004010e0
add esp, 4
mov eax, esi
jmp 0x4ca872
cmp esi, 2
jne 0x4cabf5
push 0x62896c
call fcn.004010e0
add esp, 4
mov eax, esi
jmp 0x4ca872
cmp esi, 3
jne 0x4cac0e
push 0x62897c
call fcn.004010e0
add esp, 4
mov eax, esi
jmp 0x4ca872
cmp esi, 4
jne 0x4cac27
push 0x62898c
call fcn.004010e0
add esp, 4
mov eax, esi
jmp 0x4ca872
cmp esi, 5
jne 0x4cac40
push 0x628994
call fcn.004010e0
add esp, 4
mov eax, esi
jmp 0x4ca872
cmp esi, 6
jne 0x4cac59
push 0x6289a8
call fcn.004010e0
add esp, 4
mov eax, esi
jmp 0x4ca872
cmp esi, 7
jne 0x4cac72
push 0x6289b8
call fcn.004010e0
add esp, 4
mov eax, esi
jmp 0x4ca872
cmp esi, 0x64
jne 0x4cac84
push str.Not_installed
call fcn.004010e0
add esp, 4
mov eax, esi
jmp 0x4ca872
cmp edi, 1
jle 0x4cb225
push str._signcheck
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4cace9
push 0x104
lea eax, [ebp + 0x2cc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 5
jbe 0x4cace9
call fcn.004ad4e0
lea ecx, [ebp + 0x2cc]
call fcn.0040c3a0
push eax
push 0x6289dc
call fcn.004010e0
add esp, 8
call fcn.004ad5c0
jmp 0x4ca870
cmp edi, 1
jle 0x4cb225
push str.start
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
je 0x4cad1a
push str._start
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4cad79
call fcn.004c9980
test eax, eax
jne 0x4cad3b
push str.Failed_to_start_mesh_agent
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
cmp eax, 1
jne 0x4cad58
push str.Started_the_mesh_agent
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
cmp eax, 2
jne 0x4cb6e3
push str.Mesh_agent_already_running
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
cmp edi, 1
jle 0x4cb225
push str.stop
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
je 0x4cadaa
push str._stop
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4cade4
call fcn.004c9a10
cmp eax, 1
jne 0x4cadcc
push str.Stopped_mesh_agent
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
push str.Failed_to_stop_mesh_agent
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
cmp edi, 1
jle 0x4cb225
push str.restart
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
je 0x4cae15
push str._restart
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4cae79
call fcn.004c9a10
call fcn.004c9980
test eax, eax
jne 0x4cae3b
push str.Failed_to_restart_mesh_agent
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
cmp eax, 1
jne 0x4cae58
push str.Restarted_the_mesh_agent
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
cmp eax, 2
jne 0x4cb6e3
push str.Mesh_agent_failed_to_stop
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
cmp edi, 1
jle 0x4cb225
push str._install
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4caf0b
call fcn.004c9a10
mov ecx, str.Mesh_Agent
call fcn.004c9870
mov ecx, 0x62837c
call fcn.004c9870
call fcn.004c9730
cmp eax, 1
jne 0x4caec0
push str.Mesh_agent_installed
jmp 0x4caec5
push str.Failed_to_install_mesh_agent
call fcn.004010e0
add esp, 4
push 0x104
lea eax, [ebp + 0x4d4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 5
jbe 0x4cb6e3
lea ecx, [ebp + 0x4d4]
call fcn.004c8d80
lea ecx, [ebp + 0x4d4]
call fcn.004c8990
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
cmp edi, 1
jle 0x4cb225
push str._remove
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
je 0x4caf40
push str._uninstall
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4cafd6
call fcn.004c9a10
mov ecx, 0x62837c
call fcn.004c9870
mov ecx, str.Mesh_Agent
call fcn.004c9870
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x4caf67
push str.Failed_to_uninstall_mesh_agent
jmp 0x4caf7d
cmp eax, 1
jne 0x4caf73
push str.Mesh_agent_uninstalled
jmp 0x4caf7d
cmp eax, 2
jne 0x4caf85
push str.Mesh_agent_still_running
call fcn.004010e0
add esp, 4
push 0x628b98
push reloc.WS2_32.dll_bind
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call esi
push 0x628bb8
push reloc.WS2_32.dll_accept
call esi
push 0x104
lea eax, [ebp + 0x4d4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 5
jbe 0x4cb6e3
lea ecx, [ebp + 0x4d4]
call fcn.004c8d80
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
cmp edi, 1
jle 0x4cb225
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
cmp eax, dword [str._update:]
jne 0x4cb039
mov eax, dword [ecx + 4]
cmp eax, dword [0x628bdc]
jne 0x4cb039
lea eax, [ecx + 8]
push 0
push eax
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
call edi
test eax, eax
jne 0x4cb029
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call ebx
mov eax, dword [esi + 4]
add eax, 8
push 0
push eax
push dword [esi]
call edi
test eax, eax
je 0x4cb011
call fcn.004c9980
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
cmp edi, 1
jle 0x4cb225
push str._netinfo
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4cb07c
lea ecx, [ebp - 0x2c]
call fcn.0040c090
test eax, eax
jle 0x4cb6e3
push dword [ebp - 0x2c]
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
cmp edi, 1
jle 0x4cb225
push 0x628bf0
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4cb0fc
test ebx, ebx
jne 0x4cb0a1
xor esi, esi
jmp 0x4cb0b1
push 0x104
push ebx
call fcn.0058d536
add esp, 8
mov esi, eax
mov edi, dword [ebp - 0x2c]
test edi, edi
jne 0x4cb0d4
xor eax, eax
push esi
push ebx
push eax
mov edx, edi
xor ecx, ecx
call fcn.004c9b70
add esp, 0xc
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
push 0x104
push edi
call fcn.0058d536
add esp, 8
push esi
push ebx
push eax
mov edx, edi
xor ecx, ecx
call fcn.004c9b70
add esp, 0xc
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
cmp edi, 1
jle 0x4cb225
push 0x628c00
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4cb134
push eax
push eax
push eax
xor edx, edx
lea ecx, [eax + 1]
call fcn.004c9b70
add esp, 0xc
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
cmp edi, 1
jle 0x4cb225
push str._setfirewall
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4cb1b4
push 0x104
lea eax, [ebp + 0x4d4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.004c8fd0
test eax, eax
jne 0x4cb186
push 0x628c20
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
lea ecx, [ebp + 0x4d4]
call fcn.004c8d80
lea ecx, [ebp + 0x4d4]
call fcn.004c8990
push 0x628c3c
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
cmp edi, 1
jle 0x4cb225
push str._clearfirewall
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4cb225
push 0x104
lea eax, [ebp + 0x4d4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.004c8fd0
test eax, eax
jne 0x4cb202
push str.Must_run_as_administrator
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
lea ecx, [ebp + 0x4d4]
call fcn.004c8d80
push str.Done
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
cmp edi, 2
jne 0x4cb5d8
push str._nodeidhex
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4cb326
mov dword [ebp - 0x20], eax
xor esi, esi
lea eax, [ebp - 0x24]
push eax
push 0x201
push esi
push 0x628c84
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cb302
lea eax, [ebp - 0x20]
push eax
push esi
push esi
push esi
push 0x628ca4
push dword [ebp - 0x24]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call edi
test eax, eax
jne 0x4cb2f9
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4cb2f9
push eax
call fcn.0058db11
add esp, 4
mov esi, eax
test esi, esi
jne 0x4cb2cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4bf
mov edx, 0x628cac
xor ecx, ecx
call fcn.004b4f80
push 0x4bf
push 0x628cbc
push 0x628ccc
jmp 0x4caa6d
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push 0x628cf0
push dword [ebp - 0x24]
call edi
test eax, eax
jne 0x4cb2eb
cmp dword [ebp - 0x20], eax
jne 0x4cb2f9
push esi
call fcn.0058c812
add esp, 4
xor esi, esi
mov dword [ebp - 0x20], esi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4cb314
push esi
call fcn.004010e0
add esp, 4
jmp 0x4ca870
push str.Not_defined__start_the_mesh_service_to_create_a_nodeid.
call fcn.004010e0
add esp, 4
jmp 0x4ca870
cmp edi, 2
jne 0x4cb5d8
push str._info
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4cb54c
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push 0x201
push 0
push 0x628d38
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ca870
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x62d420
push 0
push 0
push str.NodeId
push dword [ebp - 0x20]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call esi
test eax, eax
je 0x4cb3ab
mov dword [ebp - 0x1c], 0
push str.NodeId:_____none_
call fcn.004010e0
add esp, 4
jmp 0x4cb3d2
cmp dword [ebp - 0x1c], 0
jne 0x4cb3c0
push str.NodeId:_____none_
call fcn.004010e0
add esp, 4
jmp 0x4cb3d2
push 0x62d420
push str.NodeId:_____s
call fcn.004010e0
add esp, 8
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x62d420
push 0
push 0
push str.MeshId
push dword [ebp - 0x20]
call esi
test eax, eax
jne 0x4cb40b
cmp dword [ebp - 0x1c], eax
jbe 0x4cb40b
push 0x62d420
push str._r_nMeshId:_____s
call fcn.004010e0
add esp, 8
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x62d420
push 0
push 0
push str.AgentHash
push dword [ebp - 0x20]
call esi
test eax, eax
jne 0x4cb444
cmp dword [ebp - 0x1c], eax
jbe 0x4cb444
push 0x62d420
push str._r_nAgentHash:__s
call fcn.004010e0
add esp, 8
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x62d420
push 0
push 0
push str.MeshServerId
push dword [ebp - 0x20]
call esi
test eax, eax
jne 0x4cb47d
cmp dword [ebp - 0x1c], eax
jbe 0x4cb47d
push 0x62d420
push str._r_nServerId:___s
call fcn.004010e0
add esp, 8
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x62d420
push 0
push 0
push str.MeshServerUrl
push dword [ebp - 0x20]
call esi
test eax, eax
jne 0x4cb4b6
cmp dword [ebp - 0x1c], eax
jbe 0x4cb4b6
push 0x62d420
push str._r_nServerUrl:__s
call fcn.004010e0
add esp, 8
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x62d420
push 0
push 0
push str.Proxy
push dword [ebp - 0x20]
call esi
test eax, eax
jne 0x4cb4ef
cmp dword [ebp - 0x1c], eax
jbe 0x4cb4ef
push 0x62d420
push str._r_nProxy:______s
call fcn.004010e0
add esp, 8
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
push 0x62d420
push 0
push 0
push 0x628e10
push dword [ebp - 0x20]
call esi
test eax, eax
je 0x4cb526
mov dword [ebp - 0x1c], 0
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4ca870
cmp dword [ebp - 0x1c], 0
jbe 0x4cb53e
push 0x62d420
push str._r_nTag:________s
call fcn.004010e0
add esp, 8
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4ca870
cmp edi, 2
jne 0x4cb5d8
push str._resetnodeid
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4cb5d8
lea eax, [ebp - 0x2c]
push eax
push 0x20206
push 0
push str.SoftwareOpen_SourceMeshAgent2
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cb5c6
mov dword [ebp - 0x28], 1
push 4
lea eax, [ebp - 0x28]
push eax
push 4
push 0
push str.ResetNodeId
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4cb5b8
push str.NodeID_will_be_reset_next_time_the_Mesh_Agent_service_is_started.
call fcn.004010e0
add esp, 4
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4ca870
push str.Error_writing_to_registry__try_running_as_administrator.
call fcn.004010e0
add esp, 4
jmp 0x4ca870
mov ecx, 0x62837c
call fcn.004c9870
cmp edi, 1
jle 0x4cb693
push 1
push 3
push 0x628ee0
or edx, 0xffffffff
mov ecx, dword [esi + 4]
call fcn.004b42d0
add esp, 0xc
test eax, eax
je 0x4cb67b
push 1
push 0x4ca740
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov dword [ebp - 4], 1
xor ecx, ecx
call fcn.00406900
mov dword [0x62b17c], eax
mov dword [eax + 0x700], 1
push esi
mov edx, edi
call fcn.00408780
add esp, 4
call fcn.00408c30
mov dword [0x62b17c], 0
mov dword [ebp - 4], 0xfffffffe
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
push str.Mesh_Agent_available_switches:_r_n__run_______________Start_as_a_console_agent._r_n__connect___________Start_as_a_temporary_console_agent._r_n__start_____________Start_the_service._r_n__restart___________Restart_the_service._r_n__stop______________Stop_the_service._r_n__state_____________Display_the_running_state_of_the_service._r_n___signcheck________Perform_self_check._r_n___install__________Install_the_service_from_this_location._r_n___uninstall________Remove_the_service_from_this_location._r_n___nodeidhex________Return_the_current_agent_identifier._r_n___fullinstall______Copy_agent_into_program_files__install_and_launch._r_n___fulluninstall____Stop_agent_and_clean_up_the_program_files_location._r_n___proxy:host:port__Specifiy_an_HTTPS_proxy__after__fullinstall_only_._r_n___tag:xxx__________Specifiy_a_agent_tag___after__fullinstall_only_._r_n___resetnodeid______Reset_the_NodeID_next_time_the_service_is_started.
call fcn.004010e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
mov dword [ebp - 0x38], str.Mesh_Agent_background_service
mov dword [ebp - 0x34], 0x4c9530
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x4cb6e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x427
jne 0x4cb6e3
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0
push 0x4cbe40
push 0
push 0x67
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4ca870
push 1
push 0x4ca740
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov dword [ebp - 4], 0
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
cmp edi, 1
jle 0x4cb729
push 0x628948
push dword [esi + 4]
call fcn.00594adb
add esp, 8
mov ecx, 0x20
test eax, eax
cmove ebx, ecx
mov dword [ebp - 0x3c], ebx
mov ecx, ebx
call fcn.00406900
mov dword [0x62b17c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 0x24]
mov dword [eax + 0x14], edx
test ecx, ecx
jne 0x4cb777
cmp edi, 1
jle 0x4cb781
push 0x628950
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
je 0x4cb772
push str.connect
push dword [esi + 4]
call fcn.00594adb
add esp, 8
test eax, eax
jne 0x4cb781
mov eax, dword [0x62b17c]
mov dword [eax + 0x700], 1
push esi
mov edx, edi
call fcn.00408780
add esp, 4
mov eax, dword [0x62b17c]
mov esi, dword [eax + 0x6f8]
mov dword [ebp - 0x40], esi
call fcn.00408c30
mov dword [0x62b17c], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4ca872