Function at 0x4a775f
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x738]
sub esp, 0x738
push 0xfffffffffffffffe
push 0x6d3370
push 0x5c4180
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x6d9d44]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x734], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 0x740]
mov dword [ebp - 0x38], edi
mov eax, dword [ebp + 0x744]
mov dword [ebp - 0x30], eax
mov ecx, edi
shl ecx, 2
lea esi, [ecx + 4]
push 0xfffffffffffffffb
pop eax
sub eax, ecx
je 0x4a77db
cmp esi, 0xffffffef
jae 0x4a77db
lea eax, [edi*4 + 0x14]
push eax
call fcn.0060a440
pop ecx
xor ebx, ebx
jmp 0x4a77df
xor ebx, ebx
mov eax, ebx
push ebx
push ebx
mov edx, esi
mov ecx, eax
call fcn.00487604
pop ecx
pop ecx
mov esi, eax
mov dword [ebp - 0x28], esi
test edi, edi
jle 0x4a7870
mov esi, dword [ebp - 0x30]
sub eax, esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], edi
mov edi, eax
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [esi]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x30], eax
cmp eax, 0xffffffff
jae 0x4a783b
or ecx, 0xffffffff
sub ecx, eax
je 0x4a783b
cmp eax, 0xffffffef
jae 0x4a783b
add eax, 0x10
push eax
call fcn.0060a440
pop ecx
mov ecx, eax
mov eax, dword [ebp - 0x30]
jmp 0x4a783d
mov ecx, ebx
push ebx
push ebx
mov edx, eax
call fcn.00487604
pop ecx
pop ecx
mov dword [edi + esi], eax
push ebx
push ebx
push dword [ebp - 0x30]
push eax
push 0xffffffffffffffff
push dword [esi]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esi, 4
sub dword [ebp - 0x24], 1
jne 0x4a7802
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x38]
cmp edi, 1
jle 0x4a7c5b
push str._finstall
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
je 0x4a78fe
push str._funinstall
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
je 0x4a78fe
push str._fulluninstall
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
je 0x4a78fe
push str._fullinstall
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
je 0x4a78fe
push str._install
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
je 0x4a78fe
push str._uninstall
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
je 0x4a78fe
push str._state
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a7930
mov eax, dword [esi + 4]
mov dword [esi + edi*4], eax
push ebx
push ebx
push 0x14
call fcn.0060a440
pop ecx
push 4
pop edx
mov ecx, eax
call fcn.00487604
mov dword [esi + 4], eax
push 0x7617bc
push dword [eax - 0x10]
push eax
call fcn.0040117f
add esp, 0x14
inc edi
mov dword [ebp - 0x38], edi
cmp edi, 1
jle 0x4a7c5b
push str._licenses
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a7c5b
push 0x761838
call fcn.00401109
mov dword [esp], str._MeshCentral_MeshAgent:_Copyright_2006___2022_Intel_Corporation_n
call fcn.00401109
mov dword [esp], str.________________________https:__github.com_Ylianst_MeshAgent__n
call fcn.00401109
mov dword [esp], 0x7619b8
call fcn.00401109
mov dword [esp], str.___Licensed_under_the_Apache_License__Version_2.0__the__License____n
call fcn.00401109
mov dword [esp], str.___you_may_not_use_this_file_except_in_compliance_with_the_License._n
call fcn.00401109
mov dword [esp], str.___You_may_obtain_a_copy_of_the_License_at_n
call fcn.00401109
mov dword [esp], 0x761ad0
call fcn.00401109
mov dword [esp], str.___http:__www.apache.org_licenses_LICENSE_2.0_n
call fcn.00401109
mov dword [esp], 0x761ad8
call fcn.00401109
mov dword [esp], str.___Unless_required_by_applicable_law_or_agreed_to_in_writing__software_n
call fcn.00401109
mov dword [esp], str.___distributed_under_the_License_is_distributed_on_an__AS_IS__BASIS__n
call fcn.00401109
mov dword [esp], str.___WITHOUT_WARRANTIES_OR_CONDITIONS_OF_ANY_KIND__either_express_or_implied._n
call fcn.00401109
mov dword [esp], str.___See_the_License_for_the_specific_language_governing_permissions_and_n
call fcn.00401109
mov dword [esp], str.___limitations_under_the_License._n_n
call fcn.00401109
mov dword [esp], 0x761c08
call fcn.00401109
mov dword [esp], str._Duktape_Javascript_Engine:_Copyright__c__2013_2019_by_Duktape_authors__see_AUTHORS.rst__n
call fcn.00401109
mov dword [esp], str.________________________https:__github.com_svaarala_duktape__n
call fcn.00401109
mov dword [esp], str.________________________http:__opensource.org_licenses_MIT__n
call fcn.00401109
mov dword [esp], 0x761d78
call fcn.00401109
mov dword [esp], str.___Permission_is_hereby_granted__free_of_charge__to_any_person_obtaining_a_copy_n
call fcn.00401109
mov dword [esp], str.___of_this_software_and_associated_documentation_files_the__Software____to_deal_n
call fcn.00401109
mov dword [esp], str.___in_the_Software_without_restriction__including_without_limitation_the_rights_n
call fcn.00401109
mov dword [esp], str.___to_use__copy__modify__merge__publish__distribute__sublicense__and___or_sell_n
call fcn.00401109
mov dword [esp], str.___copies_of_the_Software__and_to_permit_persons_to_whom_the_Software_is_n
call fcn.00401109
mov dword [esp], str.___furnished_to_do_so__subject_to_the_following_conditions_:_n
call fcn.00401109
mov dword [esp], 0x762054
call fcn.00401109
mov dword [esp], str.___The_above_copyright_notice_and_this_permission_notice_shall_be_included_in_n
call fcn.00401109
mov dword [esp], str.___all_copies_or_substantial_portions_of_the_Software._n
call fcn.00401109
mov dword [esp], str.____n
call fcn.00401109
mov dword [esp], str.___THE_SOFTWARE_IS_PROVIDED__AS_IS___WITHOUT_WARRANTY_OF_ANY_KIND__EXPRESS_OR_n
call fcn.00401109
mov dword [esp], str.___IMPLIED__INCLUDING_BUT_NOT_LIMITED_TO_THE_WARRANTIES_OF_MERCHANTABILITY__n
call fcn.00401109
mov dword [esp], str.___FITNESS_FOR_A_PARTICULAR_PURPOSE_AND_NONINFRINGEMENT.IN_NO_EVENT_SHALL_THE_n
call fcn.00401109
mov dword [esp], str.___AUTHORS_OR_COPYRIGHT_HOLDERS_BE_LIABLE_FOR_ANY_CLAIM__DAMAGES_OR_OTHER_n
call fcn.00401109
mov dword [esp], str.___LIABILITY__WHETHER_IN_AN_ACTION_OF_CONTRACT__TORT_OR_OTHERWISE__ARISING_FROM__n
call fcn.00401109
mov dword [esp], str.___OUT_OF_OR_IN_CONNECTION_WITH_THE_SOFTWARE_OR_THE_USE_OR_OTHER_DEALINGS_IN_n
call fcn.00401109
mov dword [esp], str.___THE_SOFTWARE._n
call fcn.00401109
mov dword [esp], str._n
call fcn.00401109
mov dword [esp], str.ZLIB_Data_Compression_Library:_Copyright__c__1995_2017_Jean_loup_Gailly_and_Mark_Adler_n
call fcn.00401109
mov dword [esp], str._______________________________http:__www.zlib.net__n
call fcn.00401109
mov dword [esp], str._________________________________________________________________________________________n
call fcn.00401109
mov dword [esp], str.___This_software_is_provided_as_is__without_any_express_or_implied_n
call fcn.00401109
mov dword [esp], str.___warranty.In_no_event_will_the_authors_be_held_liable_for_any_damages_n
call fcn.00401109
mov dword [esp], str.___arising_from_the_use_of_this_software._n
call fcn.00401109
mov dword [esp], 0x761a84
call fcn.00401109
mov dword [esp], str.___Permission_is_granted_to_anyone_to_use_this_software_for_any_purpose__n
call fcn.00401109
mov dword [esp], str.___including_commercial_applications__and_to_alter_it_and_redistribute_it_n
call fcn.00401109
mov dword [esp], str.___freely__subject_to_the_following_restrictions_:_n
call fcn.00401109
mov dword [esp], 0x761d74
call fcn.00401109
mov dword [esp], str.___1._The_origin_of_this_software_must_not_be_misrepresented__you_must_not_n
call fcn.00401109
mov dword [esp], str.______claim_that_you_wrote_the_original_software.If_you_use_this_software_n
call fcn.00401109
mov dword [esp], str.______in_a_product__an_acknowledgment_in_the_product_documentation_would_be_n
call fcn.00401109
mov dword [esp], str.______appreciated_but_is_not_required._n
call fcn.00401109
mov dword [esp], str.___2._Altered_source_versions_must_be_plainly_marked_as_such__and_must_not_be_n
call fcn.00401109
mov dword [esp], str.______misrepresented_as_being_the_original_software._n
call fcn.00401109
mov dword [esp], str.___3._This_notice_may_not_be_removed_or_altered_from_any_source_distribution._n
call fcn.00401109
mov dword [esp], 0x761dfc
call fcn.00401109
mov dword [esp], str.___Jean___loup_Gailly________Mark_Adler_n
call fcn.00401109
mov dword [esp], str.___jloup_gzip.org____________madler_alumni.caltech.edu_n
call fcn.00401109
pop ecx
test dword [esi - 0x10], 0xfffffffc
jbe 0x4a7c2f
mov ecx, dword [esi + ebx*4]
call fcn.004876b9
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x4a7c1c
mov ecx, esi
call fcn.004876b9
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x734]
xor ecx, ebp
call fcn.005c0db0
lea esp, [ebp + 0x738]
pop ebp
ret
mov ecx, ebx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], ecx
mov eax, ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
cmp edi, 1
jle 0x4a7d11
push str._info
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a7d11
push str.Nov_19_2022
push str.18:12:33
push str.Compiled_on:__s___s_n
call fcn.00401109
push str.650667126c2df73961de2f478ec6b0923fb17dcd
push str.___Commit_Hash:__s_n
call fcn.00401109
push 0x762284
push str.___Commit_Date:__s_n
call fcn.00401109
push ebx
call fcn.004c4960
push eax
push str.Using__s_n
call fcn.00401109
push 3
push str.Agent_ARCHID:__d_n
call fcn.00401109
add esp, 0x30
push 0x66
pop ecx
mov esi, str.var__tmp__Detected_OS:___require_os_.Name__try_tmp________require_os_.arch____catch_x_console.log__tmp__if_process.platformwin32___tmprequire_win_authenticode_opus__process.execPath___if__tmp_null___tmp.url_null___tmprequire_win_authenticode_opus_.locked__tmp.url___if__tmp_null___console.log_LOCKED_to:____tmp.dns___console.log_______tmp.id______process.exit___
lea edi, [ebp + 0x59c]
rep movsd dword es:[edi], dword [esi]
mov esi, 0x197
mov dword [ebp - 0x20], esi
mov edx, esi
lea ecx, [ebp + 0x59c]
call fcn.0048ee63
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], esi
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x38]
cmp edi, 2
jle 0x4a7e01
push str._faddr
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a7d85
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x30]
push eax
push 0x762554
mov eax, dword [esi + 8]
add eax, 2
push eax
call fcn.0040cd5f
push ebx
push dword [ebp - 0x30]
call fcn.00489230
push 0x76f260
push 0x7625a4
call fcn.00401109
add esp, 0x1c
test dword [esi - 0x10], 0xfffffffc
jbe 0x4a7c2f
mov ecx, dword [esi + ebx*4]
call fcn.004876b9
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x4a7d6d
jmp 0x4a7c2f
cmp edi, 2
jle 0x4a7e01
push str._fdelta
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a7e01
xorps xmm0, xmm0
movlpd qword [ebp - 0x34], xmm0
lea eax, [ebp - 0x34]
push eax
push str._lld
push dword [esi + 8]
call fcn.0040cd5f
mov ecx, 0x48807d
xor eax, eax
sub ecx, dword [ebp - 0x34]
sbb eax, dword [ebp - 0x30]
push eax
push ecx
call fcn.00489230
push 0x76f260
push 0x7625f4
call fcn.00401109
add esp, 0x1c
test dword [esi - 0x10], 0xfffffffc
jbe 0x4a7c2f
mov ecx, dword [esi + ebx*4]
call fcn.004876b9
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x4a7de9
jmp 0x4a7c2f
cmp dword [ebp - 0x2c], 0
je 0x4a7e0e
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4a7e63
push 0x104
lea eax, [ebp + 0x52c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push ebx
push 0x208
lea eax, [ebp + 0x324]
push eax
push 0xffffffffffffffff
lea eax, [ebp + 0x52c]
push eax
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x30]
push eax
lea edx, [ebp - 0x24]
lea ecx, [ebp + 0x324]
call fcn.0047961f
pop ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
cmp edi, 1
jle 0x4a7ed7
mov edx, str._export
mov ecx, dword [esi + 4]
mov al, byte [ecx]
mov byte [ebp - 0x19], al
cmp al, byte [edx]
mov eax, dword [ebp - 0x20]
jne 0x4a7ea0
cmp byte [ebp - 0x19], 0
je 0x4a7e9c
mov al, byte [ecx + 1]
mov byte [ebp - 0x19], al
cmp al, byte [edx + 1]
mov eax, dword [ebp - 0x20]
jne 0x4a7ea0
add ecx, 2
add edx, 2
cmp byte [ebp - 0x19], 0
jne 0x4a7e70
mov ecx, ebx
jmp 0x4a7ea5
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x4a7ed7
test eax, eax
jne 0x4a7ed7
xor edx, edx
mov ecx, str.require_code_utils_.expand_embedded:_true__process.exit___
call fcn.0048ee63
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x4a7ec7
mov eax, ebx
jmp 0x4a7ed4
push 0x1000
push eax
call fcn.005f8590
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
cmp edi, 2
jle 0x4a7fc9
mov edx, str._exec
mov ecx, dword [esi + 4]
mov al, byte [ecx]
mov byte [ebp - 0x19], al
cmp al, byte [edx]
mov eax, dword [ebp - 0x20]
jne 0x4a7f18
cmp byte [ebp - 0x19], 0
je 0x4a7f14
mov al, byte [ecx + 1]
mov byte [ebp - 0x19], al
cmp al, byte [edx + 1]
mov eax, dword [ebp - 0x20]
jne 0x4a7f18
add ecx, 2
add edx, 2
cmp byte [ebp - 0x19], 0
jne 0x4a7ee8
mov ecx, ebx
jmp 0x4a7f1d
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x4a7f4f
test eax, eax
jne 0x4a7f4f
xor edx, edx
mov ecx, dword [esi + 8]
call fcn.0048ee63
mov ecx, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], ecx
test ecx, ecx
jne 0x4a7f3f
mov eax, ebx
jmp 0x4a7f4c
push 0x1000
push ecx
call fcn.005f8590
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
cmp edi, 2
jle 0x4a7fc9
mov edx, str._b64exec
mov ecx, dword [esi + 4]
mov al, byte [ecx]
mov byte [ebp - 0x19], al
cmp al, byte [edx]
mov eax, dword [ebp - 0x20]
jne 0x4a7f8c
cmp byte [ebp - 0x19], 0
je 0x4a7f88
mov al, byte [ecx + 1]
mov byte [ebp - 0x19], al
cmp al, byte [edx + 1]
mov eax, dword [ebp - 0x20]
jne 0x4a7f8c
add ecx, 2
add edx, 2
cmp byte [ebp - 0x19], 0
jne 0x4a7f5c
mov ecx, ebx
jmp 0x4a7f91
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x4a7fc9
test eax, eax
jne 0x4a7fc9
cmp dword [esi + 8], eax
jne 0x4a7fa2
mov eax, ebx
jmp 0x4a7fb1
push 0x10000
push dword [esi + 8]
call fcn.005f8590
pop ecx
pop ecx
lea ecx, [ebp - 0x24]
push ecx
mov edx, eax
mov ecx, dword [esi + 8]
call fcn.0048d4e2
pop ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
cmp edi, 1
jle 0x4a80a4
push str._nodeid
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a8011
push 0xd
pop ecx
mov esi, str.console.log_require__agentNodeId_____process.exit___
lea edi, [ebp + 0x6fc]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x36
pop esi
mov dword [ebp - 0x20], esi
mov edx, esi
lea ecx, [ebp + 0x6fc]
call fcn.0048ee63
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x38]
cmp edi, 1
jle 0x4a80a4
push str._name
mov eax, dword [ebp - 0x28]
push dword [eax + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a805c
push 0x10
pop ecx
mov esi, str.console.log_require__agentNodeId_.serviceName____process.exit___
lea edi, [ebp + 0x6f0]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x42
pop eax
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x6f0]
call fcn.0048ee63
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x38]
cmp edi, 1
jle 0x4a80a4
push str.exstate
mov esi, dword [ebp - 0x28]
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a80a7
push 0x32
pop ecx
mov esi, str.var_rrawState:__1__state:_NOT_INSTALLED_tryrrequire_service_manager_.manager.getService_require__agentNodeId_.serviceName___.status_catch_z__console.log_r.state__process.exit_r.rawState__
lea edi, [ebp + 0x668]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, 0xc9
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x668]
call fcn.0048ee63
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x38]
mov esi, dword [ebp - 0x28]
cmp edi, 1
jle 0x4a8149
push str.state
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a80ee
push 0x2b
pop ecx
mov esi, str.tryconsole.log_require_service_manager_.manager.getService_require__agentNodeId_.serviceName___.status.state__catch_z_console.log_NOT_INSTALLED___process.exit___
lea edi, [ebp + 0x688]
rep movsd dword es:[edi], dword [esi]
mov eax, 0xab
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x688]
call fcn.0048ee63
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x38]
cmp edi, 1
jle 0x4a8149
push str.start
mov esi, dword [ebp - 0x28]
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
je 0x4a811c
push 0x762ac4
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a814c
push 0x30
pop ecx
mov esi, str.tryrequire_service_manager_.manager.getService_require__agentNodeId_.serviceName___.start___console.log_Service_Started__catch_z_console.log_Failed_to_start_service__process.exit___
lea edi, [ebp + 0x670]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, 0xc1
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x670]
call fcn.0048ee63
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x38]
mov esi, dword [ebp - 0x28]
cmp edi, 1
jle 0x4a81ff
push str.stop
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
je 0x4a817b
push str._stop
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a81a6
push 0x44
pop ecx
mov esi, str.tryrequire_service_manager_.manager.getService_require__agentNodeId_.serviceName___.stop__.then_function_m_console.log_Service_Stopped__process.exit_____function_m_console.log_m__process.exit_____catch_z_console.log_Failed_to_stop_service__process.exit___
lea edi, [ebp + 0x624]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x10f
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x624]
call fcn.0048ee63
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x38]
cmp edi, 1
jle 0x4a81ff
push str.restart
mov esi, dword [ebp - 0x28]
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
je 0x4a81d4
push str._restart
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a8202
push 0x46
pop ecx
mov esi, str.tryrequire_service_manager_.manager.getService_require__agentNodeId_.serviceName___.restart__.then_function_m_console.log_Service_Restarted__process.exit_____function_m_console.log_m__process.exit_____catch_z_console.log_Failed_to_restart_service__process.exit___
lea edi, [ebp + 0x61c]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x117
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x61c]
call fcn.0048ee63
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x38]
mov esi, dword [ebp - 0x28]
cmp edi, 1
jle 0x4a8297
push str._agentHash
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a824d
cmp dword [ebp - 0x20], eax
jne 0x4a824d
push 0x18
pop ecx
mov esi, str.console.log_getSHA384FileHash_process.execPath_.toString_hex_.substring_0_16___process.exit___
lea edi, [ebp + 0x6d0]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x60
pop eax
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x6d0]
call fcn.0048ee63
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x38]
cmp edi, 1
jle 0x4a8297
push str._agentFullHash
mov esi, dword [ebp - 0x28]
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a829a
cmp dword [ebp - 0x20], eax
jne 0x4a829a
push 0x14
pop ecx
mov esi, str.console.log_getSHA384FileHash_process.execPath_.toString_hex___process.exit___
lea edi, [ebp + 0x6e0]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x50
pop eax
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x6e0]
call fcn.0048ee63
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x38]
mov esi, dword [ebp - 0x28]
cmp edi, 2
jne 0x4a82dc
push str._resetnodeid
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a82dc
push 0x1c
pop ecx
mov esi, str.tryrequire__agentNodeId_.resetNodeId___catch_z_console.log_This_command_requires_admin.__process.exit___
lea edi, [ebp + 0x6c0]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x70
pop eax
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x6c0]
call fcn.0048ee63
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x38]
mov esi, dword [ebp - 0x28]
cmp edi, 1
jle 0x4a83b2
push str._setfirewall
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a8329
push 0xa
pop ecx
mov esi, str.require_agent_installer_.setfirewall___
lea edi, [ebp + 0x708]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x29
pop eax
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x708]
call fcn.0048ee63
mov dword [ebp - 0x2c], eax
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x38]
cmp edi, 1
jle 0x4a83b2
push str._clearfirewall
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a836e
push 0xb
pop ecx
mov esi, str.require_agent_installer_.clearfirewall___
lea edi, [ebp + 0x708]
rep movsd dword es:[edi], dword [esi]
push 0x2b
pop esi
mov edx, esi
lea ecx, [ebp + 0x708]
call fcn.0048ee63
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], esi
mov edi, dword [ebp - 0x38]
cmp edi, 1
jle 0x4a83b2
push str._checkfirewall
mov esi, dword [ebp - 0x28]
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a83b5
push 0xb
pop ecx
mov esi, str.require_agent_installer_.checkfirewall___
lea edi, [ebp + 0x708]
rep movsd dword es:[edi], dword [esi]
push 0x2b
pop esi
mov edx, esi
lea ecx, [ebp + 0x708]
call fcn.0048ee63
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], esi
mov edi, dword [ebp - 0x38]
mov esi, dword [ebp - 0x28]
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp edi, 1
jle 0x4a8649
push str._updaterversion
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a8419
push ebx
lea eax, [ebp - 0x30]
push eax
push 2
push 0x76301c
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test dword [esi - 0x10], 0xfffffffc
jbe 0x4a7c2f
mov ecx, dword [esi + ebx*4]
call fcn.004876b9
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x4a8401
jmp 0x4a7c2f
cmp edi, 1
jle 0x4a8649
push str._kvm0
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a852e
push ebx
push ebx
xor edx, edx
push 0x10
pop ecx
call fcn.004878dc
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov dword [eax], 0x4a765a
mov dword [eax + 8], ebx
cmp edi, 2
jle 0x4a8470
push 0x7630ac
push dword [esi + 8]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a8470
xor ecx, ecx
inc ecx
jmp 0x4a8472
mov ecx, ebx
mov eax, dword [ebp - 0x30]
mov dword [eax + 0xc], ecx
cmp edi, 2
jle 0x4a8490
push 0x7630b8
push dword [esi + 8]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
je 0x4a84a8
cmp edi, 3
jle 0x4a84b2
push 0x7630c8
push dword [esi + 0xc]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a84b2
mov dword [0x769d50], 1
push 0x800
push ebx
push 0x7630d8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
mov eax, ebx
test edi, edi
je 0x4a84ea
push 0x7630e4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x4a84ee
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, ebx
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4a84fb
push 2
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4a8501
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
push dword [ebp - 0x30]
call fcn.0040e789
test dword [esi - 0x10], 0xfffffffc
jbe 0x4a7c2f
mov ecx, dword [esi + ebx*4]
call fcn.004876b9
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x4a8516
jmp 0x4a7c2f
cmp edi, 1
jle 0x4a8649
push str._kvm1
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a8649
push ebx
push ebx
xor edx, edx
push 0x10
pop ecx
call fcn.004878dc
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov dword [eax], 0x4a765a
mov dword [eax + 8], 1
cmp edi, 2
jle 0x4a8589
push str._coredump
push dword [esi + 8]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a8589
xor ecx, ecx
inc ecx
jmp 0x4a858b
mov ecx, ebx
mov eax, dword [ebp - 0x30]
mov dword [eax + 0xc], ecx
cmp edi, 2
jle 0x4a85a9
push 0x763110
push dword [esi + 8]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
je 0x4a85c1
cmp edi, 3
jle 0x4a85cb
push str._remotecursor
push dword [esi + 0xc]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a85cb
mov dword [0x769d50], 1
push 0x800
push ebx
push str.Shcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
mov eax, ebx
test edi, edi
je 0x4a8603
push str.SetProcessDpiAwareness
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x4a8607
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, ebx
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4a8614
push 2
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4a861a
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
push dword [ebp - 0x30]
call fcn.0040e789
mov edi, ebx
test dword [esi - 0x10], 0xfffffffc
jbe 0x4a9288
mov ecx, dword [esi + edi*4]
call fcn.004876b9
inc edi
mov eax, dword [esi - 0x10]
shr eax, 2
cmp edi, eax
jl 0x4a8631
jmp 0x4a9288
cmp dword [ebp - 0x2c], 0
jne 0x4a91b3
test edi, edi
jle 0x4a866d
push 0x763154
push dword [esi]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
je 0x4a91b3
cmp edi, 1
jle 0x4a88b5
push 0x76315c
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
je 0x4a91b3
push 0x763160
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
je 0x4a91b3
push str.__slave
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
je 0x4a91b3
cmp edi, 1
jle 0x4a88b5
mov ecx, dword [esi + 4]
mov edx, str._update:
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4a8880
mov eax, dword [ecx + 4]
cmp eax, dword [edx + 4]
jne 0x4a8880
push ebx
push ebx
xor edx, edx
mov ecx, 0x400
call fcn.004878dc
pop ecx
pop ecx
mov edx, eax
mov dword [ebp - 0x24], edx
mov ecx, dword [esi + 4]
cmp byte [ecx + 8], 0x2a
jne 0x4a873d
cmp edi, 2
jle 0x4a870a
mov eax, dword [esi + 8]
jmp 0x4a870f
mov eax, str.null
push eax
mov eax, str.true
mov dword [ebp - 0x30], str.false
cmp byte [ecx + 9], 0x53
cmovne eax, dword [ebp - 0x30]
push eax
push str.require_agent_installer_.update__s___s__
push 0x400
push edx
call fcn.0040117f
add esp, 0x14
jmp 0x4a87f3
cmp edi, 2
jle 0x4a87e0
mov ecx, 0x7631d8
mov eax, dword [esi + 8]
mov dl, byte [eax]
mov byte [ebp - 0x19], dl
cmp dl, byte [ecx]
mov edx, dword [ebp - 0x24]
jne 0x4a877e
cmp byte [ebp - 0x19], 0
je 0x4a877a
mov dl, byte [eax + 1]
mov byte [ebp - 0x19], dl
cmp dl, byte [ecx + 1]
mov edx, dword [ebp - 0x24]
jne 0x4a877e
add eax, 2
add ecx, 2
cmp byte [ebp - 0x19], 0
jne 0x4a874e
mov eax, ebx
jmp 0x4a8783
sbb eax, eax
or eax, 1
test eax, eax
je 0x4a87c8
mov ecx, 0x7631dc
mov eax, dword [esi + 8]
mov dl, byte [eax]
mov byte [ebp - 0x19], dl
cmp dl, byte [ecx]
mov edx, dword [ebp - 0x24]
jne 0x4a87bf
cmp byte [ebp - 0x19], 0
je 0x4a87bb
mov dl, byte [eax + 1]
mov byte [ebp - 0x19], dl
cmp dl, byte [ecx + 1]
mov edx, dword [ebp - 0x24]
jne 0x4a87bf
add eax, 2
add ecx, 2
cmp byte [ebp - 0x19], 0
jne 0x4a878f
mov eax, ebx
jmp 0x4a87c4
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4a87e0
push dword [esi + 8]
push str.require_agent_installer_.update_false____s___
push 0x400
push edx
call fcn.0040117f
add esp, 0x10
jmp 0x4a87f3
push str.require_agent_installer_.update_true__
push 0x400
push edx
call fcn.0040117f
add esp, 0xc
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 1
xor ecx, ecx
call fcn.00407fc9
mov dword [0x76a524], eax
mov ecx, dword [ebp - 0x24]
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp - 0x30]
mov dword [eax + 0x14], ecx
push esi
mov edx, edi
call fcn.0040b89b
pop ecx
mov eax, dword [0x76a524]
mov edi, dword [eax + 0xd34]
mov dword [ebp - 0x40], edi
call fcn.0040bf24
mov dword [0x76a524], ebx
mov dword [ebp - 4], 0xfffffffe
test dword [esi - 0x10], 0xfffffffc
jbe 0x4a9286
mov ecx, dword [esi + ebx*4]
call fcn.004876b9
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x4a884b
jmp 0x4a9286
cmp edi, 1
jle 0x4a88b5
push str._netinfo
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a88b5
lea ecx, [ebp - 0x30]
call fcn.004103d5
test eax, eax
jle 0x4a9188
push dword [ebp - 0x30]
call fcn.004a7094
jmp 0x4a8bde
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x50], str.Mesh_Agent_background_service
mov dword [ebp - 0x4c], 0x4a746b
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [0x76afc0], edi
mov dword [0x76afb8], esi
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x4a9188
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x427
jne 0x4a9188
cmp edi, 2
jl 0x4a8ae7
push 1
push 3
push 0x763250
or edx, 0xffffffff
mov ecx, dword [esi + 4]
call fcn.0048eb52
add esp, 0xc
test eax, eax
jne 0x4a893a
push 1
push 4
push str..zip
or edx, 0xffffffff
mov ecx, dword [esi + 4]
call fcn.0048eb52
add esp, 0xc
test eax, eax
je 0x4a899b
push 1
push 0x4a7680
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov dword [ebp - 4], 2
xor ecx, ecx
call fcn.00407fc9
mov dword [0x76a524], eax
mov dword [eax + 0xd6c], 1
push esi
mov edx, edi
call fcn.0040b89b
pop ecx
call fcn.0040bf24
mov dword [0x76a524], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x4a9188
cmp edi, 2
jne 0x4a8ae7
mov ecx, 0x76325c
mov eax, dword [esi + 4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4a89cc
test dl, dl
je 0x4a89c8
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4a89cc
add eax, 2
add ecx, 2
test dl, dl
jne 0x4a89ac
mov eax, ebx
jmp 0x4a89d1
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4a8a8d
mov edi, 0x104
push edi
lea eax, [ebp + 0x324]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
lea eax, [ebp + 0x630]
push eax
or edx, 0xffffffff
lea ecx, [ebp + 0x324]
call fcn.00486fe6
pop ecx
pop ecx
xor ecx, ecx
call fcn.00487f36
mov edi, eax
mov ecx, edi
call fcn.0048aada
push edi
push ebx
push ebx
lea eax, [ebp + 0x630]
push eax
push ebx
push ebx
push edi
push ebx
call fcn.0047b885
xor edx, edx
mov ecx, eax
call fcn.0047c10b
add esp, 0x20
mov dword [ebp - 0x30], eax
push 0xe88
push ecx
mov edx, str.require_util_language_.current.toUpperCase__.split___.join____
mov ecx, eax
call fcn.004188ff
pop ecx
pop ecx
test eax, eax
jne 0x4a8a69
push ebx
or edx, 0xffffffff
mov ecx, dword [ebp - 0x30]
call fcn.0041b03c
push eax
push str.Current_Language:__s_n
call fcn.00401109
add esp, 0xc
mov ecx, dword [ebp - 0x30]
call fcn.0045d31c
mov dword [edi], 2
mov ecx, edi
call fcn.00488135
mov ecx, edi
call fcn.0048ab6b
xor eax, eax
inc eax
mov edi, eax
mov dword [ebp - 0x30], eax
cmp edi, 2
jne 0x4a8ae7
mov ecx, dword [esi + 4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a8a98
sub ecx, edx
cmp ecx, 6
jbe 0x4a8ae7
push 6
push str._lang
push dword [esi + 4]
call fcn.005f0cf0
add esp, 0xc
test eax, eax
jne 0x4a8ae7
mov ecx, dword [esi + 4]
mov edx, ecx
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4a8ac4
sub edx, edi
push 1
push 0x76326c
call fcn.0048ec14
pop ecx
pop ecx
inc eax
add eax, dword [esi + 4]
mov dword [0x76a54c], eax
xor edi, edi
inc edi
cmp edi, 1
je 0x4a8be4
push str.Mesh_Agent_available_switches:_r_n
call fcn.00401109
mov dword [esp], str.__run_______________Start_as_a_console_agent._r_n
call fcn.00401109
mov dword [esp], str.__connect___________Start_as_a_temporary_console_agent._r_n
call fcn.00401109
mov dword [esp], str.__start_____________Start_the_service._r_n
call fcn.00401109
mov dword [esp], str.__restart___________Restart_the_service._r_n
call fcn.00401109
mov dword [esp], str.__stop______________Stop_the_service._r_n
call fcn.00401109
mov dword [esp], str.__state_____________Display_the_running_state_of_the_service._r_n
call fcn.00401109
mov dword [esp], str.___signcheck________Perform_self___check._r_n
call fcn.00401109
mov dword [esp], str.___install__________Install_the_service_from_this_location._r_n
call fcn.00401109
mov dword [esp], str.___uninstall________Remove_the_service_from_this_location._r_n
call fcn.00401109
mov dword [esp], str.___nodeid___________Return_the_current_agent_identifier._r_n
call fcn.00401109
mov dword [esp], str.___info_____________Return_agent_version_information._r_n
call fcn.00401109
mov dword [esp], str.___resetnodeid______Reset_the_NodeID_next_time_the_service_is_started._r_n
call fcn.00401109
mov dword [esp], str.___fulluninstall____Stop_agent_and_clean_up_the_program_files_location._r_n
call fcn.00401109
mov dword [esp], str.___fullinstall______Copy_agent_into_program_files__install_and_launch._r_n
call fcn.00401109
mov dword [esp], 0x76358c
call fcn.00401109
mov dword [esp], str.____________________The_following_switches_can_be_specified_after__fullinstall:_r_n
call fcn.00401109
mov dword [esp], 0x7635dc
call fcn.00401109
mov dword [esp], str._______WebProxy_http:__proxyhost:port_______Specify_an_HTTPS_proxy._r_n
call fcn.00401109
mov dword [esp], str._______agentName_alternate_name_____________Specify_an_alternate_name_to_be_provided_by_the_agent._r_n
call fcn.00401109
pop ecx
jmp 0x4a9188
cmp dword [ebp - 0x30], 0
jne 0x4a9188
mov dword [ebp - 0x24], ebx
mov edi, 0x104
push edi
lea eax, [ebp + 0x324]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
lea eax, [ebp + 0x630]
push eax
or edx, 0xffffffff
lea ecx, [ebp + 0x324]
call fcn.00486fe6
pop ecx
pop ecx
xor ecx, ecx
call fcn.00487f36
mov edi, eax
mov dword [ebp - 0x30], edi
mov ecx, edi
call fcn.0048aada
push edi
push 0x4a76a5
push ebx
lea eax, [ebp + 0x630]
push eax
push ebx
push ebx
push edi
push ebx
call fcn.0047b885
xor edx, edx
mov ecx, eax
call fcn.0047c10b
add esp, 0x20
mov edi, eax
push 0xe88
push ecx
mov edx, str.require_win_authenticode_opus_.checkMSH___
mov ecx, edi
call fcn.004188ff
pop ecx
pop ecx
test eax, eax
jne 0x4a9160
push 0xe88
push ecx
mov edx, str.require_util_language_.current.toLowerCase__.split___.join____
mov ecx, edi
call fcn.004188ff
pop ecx
pop ecx
test eax, eax
jne 0x4a8c98
push ebx
or edx, 0xffffffff
mov ecx, edi
call fcn.0041b03c
pop ecx
mov dword [ebp - 0x24], eax
push 0xe88
push ecx
mov edx, str._function_foo__return_JSON.parse__MSH__.translation______
mov ecx, edi
call fcn.004188ff
pop ecx
pop ecx
test eax, eax
jne 0x4a8cc8
push 0x7636bc
or edx, 0xffffffff
mov ecx, edi
call fcn.00419491
pop ecx
test eax, eax
jne 0x4a8e6f
mov ecx, edi
call fcn.0041c321
mov edx, str.Install
mov ecx, edi
call fcn.0041bf3d
push 0x7637f0
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.004192b8
mov edx, 0x7637f8
mov ecx, edi
call fcn.0041bf3d
mov dword [esp], 0x763804
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.004192b8
mov edx, 0x763810
mov ecx, edi
call fcn.0041bf3d
mov dword [esp], 0x763818
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.004192b8
mov edx, str.Disconnect
mov ecx, edi
call fcn.0041bf3d
mov dword [esp], 0x76382c
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.004192b8
mov edx, str.Update
mov ecx, edi
call fcn.0041bf3d
mov dword [esp], 0x763840
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.004192b8
mov ecx, edi
call fcn.0041c33d
mov edx, str.NOT_INSTALLED
mov ecx, edi
call fcn.0041bf3d
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00419f87
mov dword [esp], 0x763858
or edx, 0xffffffff
mov ecx, edi
call fcn.00419063
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00419f51
push 0xfffffffffffffffd
pop edx
mov ecx, edi
call fcn.00419f87
push ebx
xor edx, edx
inc edx
mov ecx, edi
call fcn.00417e9a
mov ecx, edi
call fcn.0041ce6d
mov edx, str.RUNNING
mov ecx, edi
call fcn.0041bf3d
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00419f87
push 0x763868
or edx, 0xffffffff
mov ecx, edi
call fcn.00419063
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00419f51
push 0xfffffffffffffffd
pop edx
mov ecx, edi
call fcn.00419f87
push ebx
xor edx, edx
inc edx
mov ecx, edi
call fcn.00417e9a
mov ecx, edi
call fcn.0041ce6d
mov edx, str.NOT_RUNNING
mov ecx, edi
call fcn.0041bf3d
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00419f87
push str.push
or edx, 0xffffffff
mov ecx, edi
call fcn.00419063
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00419f51
push 0xfffffffffffffffd
pop edx
mov ecx, edi
call fcn.00419f87
push ebx
xor edx, edx
inc edx
mov ecx, edi
call fcn.00417e9a
mov ecx, edi
call fcn.0041ce6d
push 0x763884
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.004192b8
push 0x76388c
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.004192b8
add esp, 0x2c
mov eax, dword [0x76a54c]
test eax, eax
mov ecx, dword [ebp - 0x24]
cmovne ecx, eax
mov dword [ebp - 0x24], ecx
push ecx
or edx, 0xffffffff
mov ecx, edi
call fcn.00419491
pop ecx
test eax, eax
jne 0x4a8f21
mov edx, dword [ebp - 0x24]
mov ecx, edi
call fcn.0041bf3d
or edx, 0xffffffff
mov ecx, edi
call fcn.00419f87
push str.split
or edx, 0xffffffff
mov ecx, edi
call fcn.00419063
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00419f51
mov edx, 0x763898
mov ecx, edi
call fcn.0041bf3d
xor edx, edx
inc edx
mov ecx, edi
call fcn.00417dfc
or edx, 0xffffffff
mov ecx, edi
call fcn.00419f87
push str.shift
or edx, 0xffffffff
mov ecx, edi
call fcn.00419063
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00419f51
xor edx, edx
mov ecx, edi
call fcn.00417dfc
push ebx
or edx, 0xffffffff
mov ecx, edi
call fcn.0041b03c
add esp, 0x14
mov dword [ebp - 0x24], eax
push 0xfffffffffffffffc
pop edx
mov ecx, edi
call fcn.00419f87
push dword [ebp - 0x24]
or edx, 0xffffffff
mov ecx, edi
call fcn.00419491
pop ecx
mov ecx, 0x7638a4
test eax, eax
cmovne ecx, dword [ebp - 0x24]
mov dword [ebp - 0x24], ecx
mov eax, 0x7638a8
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4a8f62
test dl, dl
je 0x4a8f5e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4a8f62
add eax, 2
add ecx, 2
test dl, dl
jne 0x4a8f42
mov eax, ebx
jmp 0x4a8f67
sbb eax, eax
or eax, 1
test eax, eax
je 0x4a8fef
push 0x7638ac
or edx, 0xffffffff
mov ecx, edi
call fcn.00419063
push dword [ebp - 0x24]
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00419063
push 0x10
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00419724
push 1
or edx, 0xffffffff
mov ecx, edi
call fcn.0041974b
add esp, 0x10
jmp 0x4a8fe1
push 0xfffffffffffffffe
pop edx
call fcn.0041a44d
push eax
push 0xfffffffffffffffc
pop edx
mov ecx, edi
call fcn.00419491
pop ecx
mov ecx, edi
test eax, eax
jne 0x4a8fcf
push 0xfffffffffffffffe
push 0xfffffffffffffffc
pop edx
call fcn.00419254
pop ecx
jmp 0x4a8fd4
call fcn.0041ce6d
push 1
or edx, 0xffffffff
mov ecx, edi
call fcn.0041974b
pop ecx
mov ecx, edi
test eax, eax
jne 0x4a8fa8
push 3
pop edx
call fcn.0041cc60
or edx, 0xffffffff
mov ecx, edi
call fcn.0041a870
mov dword [0x76a520], eax
mov dword [0x76a53c], edi
mov eax, dword [ebp - 0x24]
mov dword [0x76a528], eax
mov edx, dword [edi + 0x64]
mov ecx, edi
call fcn.0041cb7e
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00419f87
push str._start_data
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.004192b8
push 6
push 0x18075380
push ebx
mov edx, 0x4a76ee
mov ecx, edi
call fcn.0041c5eb
push str._start
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.004192b8
add esp, 0x14
push 0xe08
push ecx
mov edx, str.global.__msh___MSH__
mov ecx, edi
call fcn.004188ff
push 0x7638dc
or edx, 0xffffffff
mov ecx, edi
call fcn.00419491
add esp, 0xc
mov ecx, edi
test eax, eax
je 0x4a9145
call fcn.0041cd62
push 0xf08
push ecx
mov edx, str.global.ackJSON.parse_global.__msh.ack_
mov ecx, edi
call fcn.004188ff
pop ecx
pop ecx
push 0xf08
push ecx
mov edx, str.global.bcolorglobal.__msh.background
mov ecx, edi
call fcn.004188ff
pop ecx
pop ecx
push 0xf08
push ecx
mov edx, str.global.fcolorglobal.__msh.foreground
mov ecx, edi
call fcn.004188ff
pop ecx
pop ecx
push 0xf08
push ecx
mov edx, str.global.bimageglobal.__msh.image_global.__msh.image:default2_
mov ecx, edi
call fcn.004188ff
mov eax, dword [ebp - 0x24]
push eax
push eax
push str.global.ackTitle__global.ack.captions__s__global.ack.captions__s_.title:global.ack.captions_en_.title_
push edi
call fcn.0041c299
add esp, 0x18
push 0x909
push ecx
xor edx, edx
mov ecx, edi
call fcn.004188ff
mov eax, dword [ebp - 0x24]
push eax
push eax
push str.global.ackText__global.ack.captions__s__global.ack.captions__s_.caption:global.ack.captions_en_.caption_
push edi
call fcn.0041c299
add esp, 0x18
push 0x909
push ecx
xor edx, edx
mov ecx, edi
call fcn.004188ff
mov eax, dword [ebp - 0x24]
push eax
push eax
push str.global.ackLink___text:_global.ack.captions__s_.linkText__url:_global.ack.captions__s_.linkUrl__if_global.ackLink.textnull__global.ackLink.urlnull_delete_global.ackLink_
push edi
call fcn.0041c299
add esp, 0x18
push 0x909
push ecx
xor edx, edx
mov ecx, edi
call fcn.004188ff
pop ecx
pop ecx
mov edx, str.var_x__require_win_userconsent_.create_global.ackTitle__global.ackText____noCheck:_true__background:_global.bcolor__foreground:_global.fcolor__b64Image:_global.bimage__linkText:_global.ackLink__x.then_function_____global._OK__true_____x.pump.on_exit__function______start______
jmp 0x4a914f
call fcn.0041cd62
mov edx, str.global._OKtrue___start___
push 0xf08
push ecx
mov ecx, edi
call fcn.004188ff
pop ecx
pop ecx
jmp 0x4a9180
push ebx
or edx, 0xffffffff
mov ecx, edi
call fcn.0041b03c
push eax
push str.Error:__s
call fcn.00401109
add esp, 0xc
mov ecx, edi
call fcn.0045d31c
mov ecx, dword [ebp - 0x30]
call fcn.0048ab6b
call dword [sym.imp.ole32.dll_CoUninitialize]
test dword [esi - 0x10], 0xfffffffc
jbe 0x4a7c2f
mov ecx, dword [esi + ebx*4]
call fcn.004876b9
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x4a919b
jmp 0x4a7c2f
push 1
push 0x4a7680
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov dword [ebp - 4], ebx
mov ecx, ebx
mov dword [ebp - 0x3c], ecx
cmp edi, 1
jle 0x4a91e9
push 0x763170
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
mov ecx, ebx
push 0x20
pop edx
test eax, eax
cmove ecx, edx
mov dword [ebp - 0x3c], ecx
call fcn.00407fc9
mov edx, eax
mov dword [0x76a524], edx
mov ecx, dword [ebp - 0x2c]
mov dword [edx + 0x10], ecx
mov eax, dword [ebp - 0x20]
mov dword [edx + 0x14], eax
test ecx, ecx
jne 0x4a9237
cmp edi, 1
jle 0x4a9241
push 0x763178
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
je 0x4a9231
push 0x76317c
push dword [esi + 4]
call fcn.005f5f20
pop ecx
pop ecx
test eax, eax
jne 0x4a9241
mov edx, dword [0x76a524]
mov dword [edx + 0xd6c], 1
push esi
mov edx, edi
call fcn.0040b89b
pop ecx
mov eax, dword [0x76a524]
mov edi, dword [eax + 0xd34]
mov dword [ebp - 0x40], edi
call fcn.0040bf24
mov dword [0x76a524], ebx
mov dword [ebp - 4], 0xfffffffe
test dword [esi - 0x10], 0xfffffffc
jbe 0x4a9286
mov ecx, dword [esi + ebx*4]
call fcn.004876b9
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x4a9273
mov ebx, edi
mov ecx, esi
call fcn.004876b9
mov eax, ebx
jmp 0x4a7c38