Function at 0x14008222c
Capabilities:
Copy file
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x880
mov rax, qword [0x1401ff510]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov rsi, rdx
mov r14d, ecx
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov r13d, ebx
cmp ecx, 2
jle 0x1400822c3
lea rdx, str._faddr
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
jne 0x1400822c3
mov qword [rsp + 0x38], rbx
mov rcx, qword [rsi + 0x10]
add rcx, 2
lea r8, [rsp + 0x38]
lea rdx, str._016llx
call fcn.140006844
mov r8, qword [rsp + 0x38]
call fcn.140069428
lea rdx, [0x1402030c0]
lea rcx, [0x1401d58ec]
call fcn.140001090
xor eax, eax
jmp 0x140083083
cmp r14d, 2
jle 0x140082305
lea rdx, str._fdelta
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
jne 0x140082305
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x38]
lea rdx, str._lld
mov rcx, qword [rsi + 0x10]
call fcn.140006844
lea r8, [0x1400690c4]
sub r8, qword [rsp + 0x38]
jmp 0x1400822a4
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.14005c200
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rsp + 0x40], ebx
mov edi, 1
test r14d, r14d
jle 0x1400823c5
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsi + rax*8]
test rcx, rcx
je 0x1400823b2
mov edx, 0x103
call fcn.1401646ec
mov r8, rax
cmp rax, 7
jbe 0x14008238a
movsxd rcx, dword [rsp + 0x40]
mov rdx, qword [rsi + rcx*8]
mov ecx, dword [rdx]
cmp ecx, dword [str._proxy:]
jne 0x14008238a
movzx ecx, word [rdx + 4]
cmp cx, word [0x1401e3bc4]
jne 0x14008238a
mov al, byte [rdx + 6]
cmp al, byte [0x1401e3bc6]
jne 0x14008238a
add rdx, 7
mov qword [rsp + 0x38], rdx
jmp 0x1400823b2
cmp r8, 5
jb 0x1400823b2
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsi + rax*8]
mov eax, dword [rcx]
cmp eax, dword [str._tag:]
jne 0x1400823b2
mov al, byte [rcx + 4]
cmp al, byte [0x1401e3bcc]
jne 0x1400823b2
lea r13, [rcx + 5]
mov eax, dword [rsp + 0x40]
add eax, edi
mov dword [rsp + 0x40], eax
cmp eax, r14d
jl 0x140082333
cmp r14d, edi
jle 0x140082440
lea rdx, str._kvm0
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
jne 0x140082408
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 0x18]
call fcn.140068c34
lea rcx, [0x1400821b4]
mov qword [rax], rcx
mov dword [rax + 0x10], ebx
mov rcx, rax
call fcn.140007b64
jmp 0x1400822bc
cmp r14d, edi
jle 0x140082440
lea rdx, str._kvm1
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
jne 0x140082440
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 0x18]
call fcn.140068c34
lea rcx, [0x1400821b4]
mov qword [rax], rcx
mov dword [rax + 0x10], edi
jmp 0x1400823fb
mov r12, qword [rsp + 0x48]
test r12, r12
jne 0x140082fba
test r14d, r14d
jle 0x14008246a
lea rdx, str.__slave
mov rcx, qword [rsi]
call fcn.14016d050
test eax, eax
je 0x140082fba
cmp r14d, edi
jle 0x1400825d5
lea rdx, [0x1401d5dd0]
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
je 0x140082fba
lea rdx, str.connect
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
je 0x140082fba
lea rdx, str.__slave
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
je 0x140082fba
cmp r14d, edi
jle 0x1400825d5
lea rdx, str.state
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
jne 0x14008255e
call fcn.1400814e0
mov ebx, eax
cmp eax, edi
jne 0x1400824f0
lea rcx, str.Stopped
jmp 0x140082554
cmp ebx, 2
jne 0x1400824fe
lea rcx, str.Start_Pending
jmp 0x140082554
cmp ebx, 3
jne 0x14008250c
lea rcx, str.Stop_Pending
jmp 0x140082554
cmp ebx, 4
jne 0x14008251a
lea rcx, str.Running
jmp 0x140082554
cmp ebx, 5
jne 0x140082528
lea rcx, str.Continue_Pending
jmp 0x140082554
cmp ebx, 6
jne 0x140082536
lea rcx, str.Pause_Pending
jmp 0x140082554
cmp ebx, 7
jne 0x140082544
lea rcx, str.Paused
jmp 0x140082554
cmp ebx, 0x64
jne 0x140083071
lea rcx, str.Not_installed
call fcn.140001090
jmp 0x140083071
cmp r14d, edi
jle 0x1400825d5
lea rdx, str._signcheck
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
jne 0x1400825d5
mov r15d, 0x104
mov r8d, r15d
lea rdx, [rsp + 0x760]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 5
jbe 0x1400825db
call fcn.140067284
lea rcx, [rsp + 0x760]
call fcn.140009c10
mov edx, eax
lea rcx, [0x1401dcca8]
call fcn.140001090
mov eax, dword [0x140202dcc]
sub eax, edi
mov dword [0x140202dcc], eax
test eax, eax
jg 0x1400822bc
call fcn.140099f30
jmp 0x1400822bc
mov r15d, 0x104
cmp r14d, edi
jle 0x140082a33
lea rdx, str.start
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
je 0x14008260c
lea rdx, str._start
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
jne 0x140082646
call fcn.140081584
test eax, eax
jne 0x140082621
lea rcx, str.Failed_to_start_mesh_agent
jmp 0x140082f23
cmp eax, edi
jne 0x140082631
lea rcx, str.Started_the_mesh_agent
jmp 0x140082f23
cmp eax, 2
jne 0x140082faf
lea rcx, str.Mesh_agent_already_running
jmp 0x140082f23
cmp r14d, edi
jle 0x140082a33
lea rdx, str.stop
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
je 0x140082677
lea rdx, str._stop
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
jne 0x140082698
call fcn.140081640
cmp eax, edi
jne 0x14008268c
lea rcx, str.Stopped_mesh_agent
jmp 0x140082f23
lea rcx, str.Failed_to_stop_mesh_agent
jmp 0x140082f23
cmp r14d, edi
jle 0x140082a33
lea rdx, str.restart
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
je 0x1400826c9
lea rdx, str._restart
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
jne 0x140082708
call fcn.140081640
call fcn.140081584
test eax, eax
jne 0x1400826e3
lea rcx, str.Failed_to_restart_mesh_agent
jmp 0x140082f23
cmp eax, edi
jne 0x1400826f3
lea rcx, str.Restarted_the_mesh_agent
jmp 0x140082f23
cmp eax, 2
jne 0x140082faf
lea rcx, str.Mesh_agent_failed_to_stop
jmp 0x140082f23
cmp r14d, edi
jle 0x140082a33
lea rdx, str._install
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
jne 0x140082799
call fcn.140081640
lea rcx, str.Mesh_Agent
call fcn.140081428
lea rcx, [0x1401e3a28]
call fcn.140081428
call fcn.14008129c
cmp eax, edi
lea rcx, str.Mesh_agent_installed
je 0x140082759
lea rcx, str.Failed_to_install_mesh_agent
call fcn.140001090
mov r8d, r15d
lea rdx, [rsp + 0x550]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 5
jbe 0x140082faf
lea rcx, [rsp + 0x550]
call fcn.140080910
lea rcx, [rsp + 0x550]
call fcn.140080484
jmp 0x140082faf
cmp r14d, edi
jle 0x140082a33
lea rdx, str._remove
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
je 0x1400827ce
lea rdx, str._uninstall
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
jne 0x140082870
call fcn.140081640
lea rcx, [0x1401e3a28]
call fcn.140081428
lea rcx, str.Mesh_Agent
call fcn.140081428
mov dword [rsp + 0x40], eax
test eax, eax
jne 0x1400827fc
lea rcx, str.Failed_to_uninstall_mesh_agent
jmp 0x140082815
cmp eax, edi
jne 0x140082809
lea rcx, str.Mesh_agent_uninstalled
jmp 0x140082815
cmp eax, 2
jne 0x14008281a
lea rcx, str.Mesh_agent_still_running
call fcn.140001090
lea rdx, str.SoftwareOpen_SourceMeshAgent2
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea rdx, str.SoftwareOpen_SourceMeshAgent2
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov r8d, r15d
lea rdx, [rsp + 0x550]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 5
jbe 0x140082faf
lea rcx, [rsp + 0x550]
call fcn.140080910
jmp 0x140082faf
cmp r14d, edi
jle 0x140082a33
mov rdx, qword [rsi + 8]
mov rax, qword [rdx]
cmp rax, qword [str._update:]
jne 0x1400828b8
jmp 0x14008289a
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rsi + 8]
xor r8d, r8d
add rdx, 8
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x14008288b
call fcn.140081584
jmp 0x140082faf
cmp r14d, edi
jle 0x140082a33
lea rdx, str._netinfo
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
jne 0x1400828f1
lea rcx, [rsp + 0x48]
call fcn.140009954
test eax, eax
jle 0x140082faf
mov rcx, qword [rsp + 0x48]
jmp 0x140082f23
cmp r14d, edi
jle 0x140082a33
lea rdx, str._fullinstall
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
jne 0x14008294f
test r13, r13
jne 0x140082918
mov rdi, rbx
jmp 0x140082926
mov rdx, r15
mov rcx, r13
call fcn.1401646ec
mov rdi, rax
mov rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x14008293e
mov rdx, r15
mov rcx, rsi
call fcn.1401646ec
mov rbx, rax
mov dword [rsp + 0x20], edi
mov r9, r13
mov r8d, ebx
mov rdx, rsi
xor ecx, ecx
jmp 0x14008297a
cmp r14d, edi
jle 0x140082a33
lea rdx, str._fulluninstall
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
jne 0x140082984
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, edi
call fcn.1400817e4
jmp 0x140082faf
cmp r14d, edi
jle 0x140082a33
lea rdx, str._setfirewall
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
jne 0x1400829e5
mov r8d, r15d
lea rdx, [rsp + 0x550]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.140080b94
test eax, eax
jne 0x1400829c9
lea rcx, str.Must_run_as_administrator
jmp 0x140082f23
lea rcx, [rsp + 0x550]
call fcn.140080910
lea rcx, [rsp + 0x550]
call fcn.140080484
jmp 0x140082a27
cmp r14d, edi
jle 0x140082a33
lea rdx, str._clearfirewall
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
jne 0x140082a33
mov r8d, r15d
lea rdx, [rsp + 0x550]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.140080b94
test eax, eax
je 0x1400829bd
lea rcx, [rsp + 0x550]
call fcn.140080910
lea rcx, str.Done
jmp 0x140082f23
cmp r14d, 2
jne 0x140082ea2
lea rdx, str._nodeidhex
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
jne 0x140082b7c
mov dword [rsp + 0x30], ebx
mov rsi, rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
lea rdx, str.SoftwareOpen_SourceMeshAgent2
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140082b63
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.NodeId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140082b58
cmp dword [rsp + 0x30], ebx
jbe 0x140082b58
mov ecx, dword [rsp + 0x30]
call fcn.140164d80
mov rsi, rax
test rax, rax
jne 0x140082b18
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov edi, 0xfe
mov r9d, edi
mov ebx, 0x445
mov r8d, ebx
lea rdx, str.ServiceMain.c
xor ecx, ecx
call fcn.14006e59c
mov r8d, ebx
lea rdx, str.ServiceMain.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.140001090
mov ecx, edi
call fcn.14015ecf8
int3
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.NodeId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140082b49
cmp dword [rsp + 0x30], ebx
jne 0x140082b58
mov rcx, rsi
call fcn.140163938
mov rsi, rbx
mov dword [rsp + 0x30], ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rsi, rsi
mov rcx, rsi
jne 0x140082b72
lea rcx, str.Not_defined__start_the_mesh_service_to_create_a_nodeid.
call fcn.140001090
jmp 0x1400822bc
cmp r14d, 2
jne 0x140082ea2
lea rdx, str._info
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
jne 0x140082e05
mov dword [rsp + 0x30], ebx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
lea rdx, str.SoftwareOpen_SourceMeshAgent2
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400822bc
mov esi, 0x10000
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdi, [0x1402040c0]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.NodeId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
jne 0x140082c24
lea rcx, str.NodeId:_____none_
call fcn.140001090
jmp 0x140082c33
mov rdx, rdi
lea rcx, str.NodeId:_____s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MeshId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x140082c7e
mov rdx, rdi
lea rcx, str._r_nMeshId:_____s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.AgentHash
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x140082cc9
mov rdx, rdi
lea rcx, str._r_nAgentHash:__s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MeshServerId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x140082d14
mov rdx, rdi
lea rcx, str._r_nServerId:___s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MeshServerUrl
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x140082d5f
mov rdx, rdi
lea rcx, str._r_nServerUrl:__s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Proxy
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x140082daa
mov rdx, rdi
lea rcx, str._r_nProxy:______s
call fcn.140001090
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401d58f4]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x140082df5
mov rdx, rdi
lea rcx, str._r_nTag:________s
call fcn.140001090
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400822bc
cmp r14d, 2
jne 0x140082ea2
lea rdx, str._resetnodeid
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
jne 0x140082ea2
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SoftwareOpen_SourceMeshAgent2
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140082e96
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 2]
xor r8d, r8d
lea rdx, str.ResetNodeId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140082df5
lea rcx, str.NodeID_will_be_reset_next_time_the_Mesh_Agent_service_is_started.
call fcn.140001090
jmp 0x140082df5
lea rcx, str.Error_writing_to_registry__try_running_this_as_administrator.
jmp 0x140082b72
lea rcx, [0x1401e3a28]
call fcn.140081428
cmp r14d, edi
jle 0x140082f2d
mov dword [rsp + 0x20], edi
mov r9d, 3
lea r8, [0x1401d5f84]
or edx, 0xffffffff
mov rcx, qword [rsi + 8]
call fcn.14006d8fc
test eax, eax
je 0x140082f1c
mov edx, edi
lea rcx, [0x1400821f8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop
xor ecx, ecx
call fcn.140004b8c
mov qword [0x140202e10], rax
mov dword [rax + 0x728], edi
mov r8, rsi
mov edx, r14d
call fcn.140005f84
call fcn.1400063a0
nop
jmp 0x140082faf
lea rcx, str.Mesh_Agent_available_switches:_r_n__run_______________Start_as_a_console_agent._r_n__connect___________Start_as_a_temporary_console_agent._r_n__start_____________Start_the_service._r_n__restart___________Restart_the_service._r_n__stop______________Stop_the_service._r_n__state_____________Display_the_running_state_of_the_service._r_n___signcheck________Perform_self_check._r_n___install__________Install_the_service_from_this_location._r_n___uninstall________Remove_the_service_from_this_location._r_n___nodeidhex________Return_the_current_agent_identifier._r_n___fullinstall______Copy_agent_into_program_files__install_and_launch._r_n___fulluninstall____Stop_agent_and_clean_up_the_program_files_location._r_n___proxy:host:port__Specifiy_an_HTTPS_proxy__after__fullinstall_only_._r_n___tag:xxx__________Specifiy_a_agent_tag___after__fullinstall_only_._r_n___resetnodeid______Reset_the_NodeID_next_time_the_service_is_started.
call fcn.140001090
jmp 0x140082faf
lea rax, str.Mesh_Agent_background_service
mov qword [rsp + 0x58], rax
lea rax, [0x1400810dc]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x140082faf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x427
jne 0x140082faf
call qword [sym.imp.KERNEL32.dll_FreeConsole]
call fcn.140080b94
xor ecx, ecx
test eax, eax
jne 0x140082f96
lea r9d, [rcx + 0x10]
lea r8, str.Mesh_Agent
lea rdx, str.Must_run_as_administrator
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140082faf
mov qword [rsp + 0x20], rbx
lea r9, [0x140083488]
xor r8d, r8d
lea edx, [r8 + 0x67]
call qword [sym.imp.USER32.dll_DialogBoxParamA]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x1400822bc
mov edx, edi
lea rcx, [0x1400821f8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop
mov r15d, ebx
mov dword [rsp + 0x44], ebx
cmp r14d, edi
jle 0x140082ff6
lea rdx, str.connect
mov rcx, qword [rsi + 8]
call fcn.14016d050
mov ecx, 0x20
test eax, eax
cmove r15d, ecx
mov dword [rsp + 0x44], r15d
mov ecx, r15d
call fcn.140004b8c
mov qword [0x140202e10], rax
mov qword [rax + 0x18], r12
mov ecx, dword [rsp + 0x30]
mov dword [rax + 0x20], ecx
test r12, r12
jne 0x140083049
cmp r14d, edi
jle 0x14008304f
lea rdx, [0x1401d5dd0]
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
je 0x140083042
lea rdx, str.connect
mov rcx, qword [rsi + 8]
call fcn.14016d050
test eax, eax
jne 0x14008304f
mov rax, qword [0x140202e10]
mov dword [rax + 0x728], edi
mov r8, rsi
mov edx, r14d
call fcn.140005f84
mov rax, qword [0x140202e10]
mov ebx, dword [rax + 0x724]
mov dword [rsp + 0x50], ebx
call fcn.1400063a0
nop
mov eax, ebx
jmp 0x140083083
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.14015c600
lea r11, [rsp + 0x880]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret