Function at 0x1400208f0
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x5a8
lea rdi, [rsp + 0x50]
mov ecx, 0x156
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x5c0]
mov rax, qword [0x140575740]
xor rax, rsp
mov qword [rsp + 0x590], rax
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x74], 0
mov dword [rsp + 0x94], 0
mov qword [rsp + 0xb8], 0
mov dword [rsp + 0xd4], 0xc00
mov dword [rsp + 0xf4], 1
mov dword [rsp + 0x104], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x1e8], 0
mov qword [rsp + 0x208], 0
mov dword [rsp + 0x214], 0
mov qword [rsp + 0x278], 0
mov qword [rsp + 0x280], 0
mov dword [rsp + 0x354], 0
mov qword [rsp + 0x368], 0
mov dword [rsp + 0x4f4], 0xffffffff
mov qword [rsp + 0x508], 0
mov qword [rsp + 0x510], 0
mov qword [rsp + 0x528], 0
mov dword [rsp + 0x564], 4
mov rcx, qword [rsp + 0x5c0]
call fcn.14001f390
test eax, eax
jne 0x140020a49
xor eax, eax
jmp 0x1400217ed
mov rax, qword [rsp + 0x5e8]
mov qword [rax], 0
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x238]
call fcn.140410c60
mov r8d, 0x40
xor edx, edx
lea rcx, [rsp + 0x2a0]
call fcn.140410c60
nop
xor r8d, r8d
lea rdx, [0x140418330]
lea rcx, [rsp + 0x128]
call sub.ncrypt.dll_NCryptOpenStorageProvider
test eax, eax
jge 0x140020aa8
jmp 0x1400216a7
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
lea r9, [0x140418380]
lea r8, [0x140418398]
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x128]
call sub.ncrypt.dll_NCryptCreatePersistedKey
test eax, eax
jge 0x140020ae9
jmp 0x1400216a9
mov dword [rsp + 0x20], 0x80000040
mov r9d, 4
lea r8, [rsp + 0xd4]
lea rdx, [0x1404183a0]
mov rcx, qword [rsp + 0xb8]
call sub.ncrypt.dll_NCryptSetProperty
test eax, eax
jge 0x140020b5a
mov dword [rsp + 0xd4], 0x800
mov dword [rsp + 0x20], 0x80000040
mov r9d, 4
lea r8, [rsp + 0xd4]
lea rdx, str.Length
mov rcx, qword [rsp + 0xb8]
call sub.ncrypt.dll_NCryptSetProperty
test eax, eax
jge 0x140020b5a
jmp 0x1400216ab
mov dword [rsp + 0x20], 0x80000040
mov r9d, 4
lea r8, [rsp + 0xf4]
lea rdx, str.Export_Policy
mov rcx, qword [rsp + 0xb8]
call sub.ncrypt.dll_NCryptSetProperty
test eax, eax
jge 0x140020b92
jmp 0x1400216ad
mov edx, 0x40
mov rcx, qword [rsp + 0xb8]
call sub.ncrypt.dll_NCryptFinalizeKey
test eax, eax
jge 0x140020bb2
jmp 0x1400216af
lea rax, [rsp + 0x354]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 1
mov edx, 1
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.CRYPT32.dll_CryptExportPublicKeyInfo]
test eax, eax
jne 0x140020be9
jmp 0x1400216b1
mov eax, dword [rsp + 0x354]
mov ecx, eax
call fcn.1403c4e30
mov qword [rsp + 0x368], rax
cmp qword [rsp + 0x368], 0
jne 0x140020c52
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x25a
lea rdx, [0x1404183e0]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x25a
lea rdx, [0x140418430]
lea rcx, [0x140418478]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
lea rax, [rsp + 0x354]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x368]
mov r8d, 1
mov edx, 1
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.CRYPT32.dll_CryptExportPublicKeyInfo]
test eax, eax
jne 0x140020c8e
jmp 0x1400216b3
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x1f4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 3
mov rdx, qword [rsp + 0x5c8]
mov ecx, 1
call qword [sym.imp.CRYPT32.dll_CertStrToNameA]
test eax, eax
jne 0x140020cd7
jmp 0x1400216b3
mov eax, dword [rsp + 0x1f4]
mov ecx, eax
call fcn.1403c4e30
mov qword [rsp + 0x1e8], rax
cmp qword [rsp + 0x1e8], 0
jne 0x140020d40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x25f
lea rdx, [0x1404184a0]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x25f
lea rdx, [0x1404184f0]
lea rcx, [0x140418538]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x1f4]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 3
mov rdx, qword [rsp + 0x5c8]
mov ecx, 1
call qword [sym.imp.CRYPT32.dll_CertStrToNameA]
test eax, eax
jne 0x140020d8d
jmp 0x1400216b3
mov eax, dword [rsp + 0x1f4]
mov dword [rsp + 0x198], eax
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x214]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 3
mov rdx, qword [rsp + 0x5d0]
mov ecx, 1
call qword [sym.imp.CRYPT32.dll_CertStrToNameW]
test eax, eax
jne 0x140020df4
jmp 0x1400216b3
mov eax, dword [rsp + 0x214]
mov ecx, eax
call fcn.1403c4e30
mov qword [rsp + 0x208], rax
cmp qword [rsp + 0x208], 0
jne 0x140020e5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x266
lea rdx, [0x140418560]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x266
lea rdx, [0x1404185b0]
lea rcx, [0x1404185f8]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x214]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 3
mov rdx, qword [rsp + 0x5d0]
mov ecx, 1
call qword [sym.imp.CRYPT32.dll_CertStrToNameW]
test eax, eax
jne 0x140020eaa
jmp 0x1400216b3
mov eax, dword [rsp + 0x214]
mov dword [rsp + 0x1c8], eax
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x1d0], rax
mov r8d, 0xd0
xor edx, edx
lea rcx, [rsp + 0x380]
call fcn.140410c60
lea rcx, [rsp + 0x468]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [rsp + 0x468]
dec eax
mov word [rsp + 0x468], ax
lea rdx, [rsp + 0x498]
lea rcx, [rsp + 0x468]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
movzx eax, word [rsp + 0x468]
add eax, 0x1e
mov word [rsp + 0x468], ax
lea rdx, [rsp + 0x4b8]
lea rcx, [rsp + 0x468]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rdx, [rsp + 0x4d8]
mov ecx, 8
call fcn.140020020
mov dword [rsp + 0x380], 2
mov dword [rsp + 0x388], 8
lea rax, [rsp + 0x4d8]
mov qword [rsp + 0x390], rax
lea rax, str.1.2.840.113549.1.1.12
mov qword [rsp + 0x398], rax
lea rax, [rsp + 0x3b0]
lea rcx, [rsp + 0x198]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x498]
mov qword [rsp + 0x3c0], rax
mov rax, qword [rsp + 0x4b8]
mov qword [rsp + 0x3c8], rax
lea rax, [rsp + 0x3d0]
lea rcx, [rsp + 0x1c8]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x3e0]
mov rdi, rax
mov rsi, qword [rsp + 0x368]
mov ecx, 0x30
rep movsb byte [rdi], byte [rsi]
cmp dword [rsp + 0x5d8], 1
jne 0x14002101d
mov dword [rsp + 0x2f8], 1
lea rax, str.1.3.6.1.5.5.7.3.1
mov qword [rsp + 0x300], rax
jmp 0x14002105a
cmp dword [rsp + 0x5d8], 2
jne 0x140021043
mov dword [rsp + 0x2f8], 4
lea rax, str.1.3.6.1.5.5.7.3.2
mov qword [rsp + 0x300], rax
jmp 0x14002105a
mov dword [rsp + 0x2f8], 0
mov qword [rsp + 0x300], 0
cmp dword [rsp + 0x2f8], 0
je 0x140021327
mov byte [rsp + 0x574], 0xa8
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x328]
call fcn.140410c60
mov dword [rsp + 0x328], 1
lea rax, [rsp + 0x574]
mov qword [rsp + 0x330], rax
lea rax, [rsp + 0x354]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x328]
mov edx, reloc.WS2_32.dll_ntohl
mov ecx, 1
call qword [sym.imp.CRYPT32.dll_CryptEncodeObject]
test eax, eax
jne 0x1400210d6
jmp 0x1400216b3
mov eax, dword [rsp + 0x354]
mov ecx, eax
call fcn.1403c4e30
mov qword [rsp + 0x280], rax
cmp qword [rsp + 0x280], 0
jne 0x14002113f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x2a0
lea rdx, [0x140418640]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x2a0
lea rdx, [0x140418690]
lea rcx, [0x1404186d8]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
lea rax, [rsp + 0x354]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x280]
lea r8, [rsp + 0x328]
mov edx, reloc.WS2_32.dll_ntohl
mov ecx, 1
call qword [sym.imp.CRYPT32.dll_CryptEncodeObject]
test eax, eax
jne 0x14002117a
jmp 0x1400216b3
mov eax, 0x20
imul rax, rax, 0
lea rcx, str.2.5.29.15
mov qword [rsp + rax + 0x2a0], rcx
mov eax, 0x20
imul rax, rax, 0
mov dword [rsp + rax + 0x2a8], 0
mov eax, 0x20
imul rax, rax, 0
mov ecx, dword [rsp + 0x354]
mov dword [rsp + rax + 0x2b0], ecx
mov eax, 0x20
imul rax, rax, 0
mov rcx, qword [rsp + 0x280]
mov qword [rsp + rax + 0x2b8], rcx
lea rax, [rsp + 0x354]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x2f8]
mov edx, 0x24
mov ecx, 1
call qword [sym.imp.CRYPT32.dll_CryptEncodeObject]
test eax, eax
jne 0x14002120c
jmp 0x1400216b3
mov eax, dword [rsp + 0x354]
mov ecx, eax
call fcn.1403c4e30
mov qword [rsp + 0x278], rax
cmp qword [rsp + 0x278], 0
jne 0x140021275
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x2a9
lea rdx, [0x140418710]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x2a9
lea rdx, [0x140418760]
lea rcx, [0x1404187a8]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
lea rax, [rsp + 0x354]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x278]
lea r8, [rsp + 0x2f8]
mov edx, 0x24
mov ecx, 1
call qword [sym.imp.CRYPT32.dll_CryptEncodeObject]
test eax, eax
jne 0x1400212b0
jmp 0x1400216b3
mov eax, 0x20
imul rax, rax, 1
lea rcx, str.2.5.29.37
mov qword [rsp + rax + 0x2a0], rcx
mov eax, 0x20
imul rax, rax, 1
mov dword [rsp + rax + 0x2a8], 0
mov eax, 0x20
imul rax, rax, 1
mov ecx, dword [rsp + 0x354]
mov dword [rsp + rax + 0x2b0], ecx
mov eax, 0x20
imul rax, rax, 1
mov rcx, qword [rsp + 0x278]
mov qword [rsp + rax + 0x2b8], rcx
mov dword [rsp + 0x440], 2
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x448], rax
lea rax, [rsp + 0x94]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
mov edx, 0x10040
mov rax, qword [rsp + 0x5c0]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.CRYPT32.dll_CryptAcquireCertificatePrivateKey]
test eax, eax
jne 0x14002136b
jmp 0x1400216b3
lea rax, [rsp + 0x4f4]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x398]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x380]
mov qword [rsp + 0x20], rax
mov r9d, 2
mov r8d, 1
mov edx, 1
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.CRYPT32.dll_CryptSignAndEncodeCertificate]
test eax, eax
jne 0x1400213ce
jmp 0x1400216b3
mov eax, dword [rsp + 0x4f4]
mov ecx, eax
call fcn.1403c4e30
mov qword [rsp + 0x508], rax
cmp qword [rsp + 0x508], 0
jne 0x140021437
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x2b7
lea rdx, [0x1404187e0]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x2b7
lea rdx, [0x140418830]
lea rcx, [0x140418878]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
lea rax, [rsp + 0x4f4]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x508]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x398]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x380]
mov qword [rsp + 0x20], rax
mov r9d, 2
mov r8d, 1
mov edx, 1
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.CRYPT32.dll_CryptSignAndEncodeCertificate]
test eax, eax
jne 0x14002149e
jmp 0x1400216b3
mov qword [rsp + 0x20], 0
mov r9d, 0x2000
xor r8d, r8d
mov edx, 1
mov ecx, 2
call qword [sym.imp.CRYPT32.dll_CertOpenStore]
mov qword [rsp + 0x510], rax
cmp qword [rsp + 0x510], 0
jne 0x1400214dd
jmp 0x1400216b3
lea rax, [rsp + 0x528]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, dword [rsp + 0x4f4]
mov r8, qword [rsp + 0x508]
mov edx, 1
mov rcx, qword [rsp + 0x510]
call qword [sym.imp.CRYPT32.dll_CertAddEncodedCertificateToStore]
test eax, eax
jne 0x140021523
jmp 0x1400216b3
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x148]
call fcn.140410c60
lea rax, str.MeshDummy
mov qword [rsp + 0x148], rax
lea rax, str.Microsoft_Software_Key_Storage_Provider
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x158], 0
mov dword [rsp + 0x15c], 0
mov dword [rsp + 0x170], 0
lea r9, [rsp + 0x148]
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0x528]
call qword [sym.imp.CRYPT32.dll_CertSetCertificateContextProperty]
test eax, eax
jne 0x1400215a3
jmp 0x1400216b3
mov r8d, reloc.WS2_32.dll_recv
xor edx, edx
lea rcx, [rsp + 0x548]
call fcn.140410c60
nop
mov r9d, dword [rsp + 0x564]
mov r8, qword [rsp + 0x5e0]
lea rdx, [rsp + 0x548]
mov rcx, qword [rsp + 0x510]
call qword [sym.imp.CRYPT32.dll_PFXExportCertStore]
test eax, eax
jne 0x1400215ed
jmp 0x1400216b3
mov eax, dword [rsp + 0x548]
mov ecx, eax
call fcn.1403c4e30
mov qword [rsp + 0x550], rax
cmp qword [rsp + 0x550], 0
jne 0x140021656
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x2d2
lea rdx, [0x140418910]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x2d2
lea rdx, str.C:UsersyfjvyDownloadsMeshAgent_mastermeshcorewincrypto.cpp
lea rcx, [0x1404189a8]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
mov r9d, dword [rsp + 0x564]
mov r8, qword [rsp + 0x5e0]
lea rdx, [rsp + 0x548]
mov rcx, qword [rsp + 0x510]
call qword [sym.imp.CRYPT32.dll_PFXExportCertStore]
test eax, eax
jne 0x140021684
jmp 0x1400216b3
mov rax, qword [rsp + 0x5e8]
mov rcx, qword [rsp + 0x550]
mov qword [rax], rcx
mov eax, dword [rsp + 0x548]
mov dword [rsp + 0x104], eax
jmp 0x1400216b3
jmp 0x1400216b3
jmp 0x1400216b3
jmp 0x1400216b3
jmp 0x1400216b3
jmp 0x1400216b3
jmp 0x1400216b3
cmp qword [rsp + 0x108], 0
je 0x1400216cc
mov rcx, qword [rsp + 0x108]
call sub.ncrypt.dll_NCryptFreeObject
nop
cmp qword [rsp + 0x128], 0
je 0x1400216e5
mov rcx, qword [rsp + 0x128]
call sub.ncrypt.dll_NCryptFreeObject
nop
cmp dword [rsp + 0x94], 0
je 0x140021719
cmp qword [rsp + 0x58], 0
je 0x140021719
cmp dword [rsp + 0x74], 0xffffffff
jne 0x14002170b
mov rcx, qword [rsp + 0x58]
call sub.ncrypt.dll_NCryptFreeObject
nop
jmp 0x140021719
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
nop
cmp qword [rsp + 0x368], 0
je 0x140021732
mov rcx, qword [rsp + 0x368]
call fcn.1403c4e00
nop
cmp qword [rsp + 0x108], 0
je 0x14002174c
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
nop
cmp qword [rsp + 0x1e8], 0
je 0x140021765
mov rcx, qword [rsp + 0x1e8]
call fcn.1403c4e00
nop
cmp qword [rsp + 0x208], 0
je 0x14002177e
mov rcx, qword [rsp + 0x208]
call fcn.1403c4e00
nop
cmp qword [rsp + 0x110], 0
je 0x140021798
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
nop
cmp qword [rsp + 0x510], 0
je 0x1400217b4
xor edx, edx
mov rcx, qword [rsp + 0x510]
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
nop
cmp qword [rsp + 0x278], 0
je 0x1400217cd
mov rcx, qword [rsp + 0x278]
call fcn.1403c4e00
nop
cmp qword [rsp + 0x280], 0
je 0x1400217e6
mov rcx, qword [rsp + 0x280]
call fcn.1403c4e00
nop
mov eax, dword [rsp + 0x104]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140419e80]
call fcn.14037c300
mov rax, rdi
mov rcx, qword [rsp + 0x590]
xor rcx, rsp
call fcn.14037c650
add rsp, 0x5a8
pop rdi
pop rsi
ret