Function at 0x140196fc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
mov eax, 0x18d8
call fcn.14037c5f0
sub rsp, rax
lea rdi, [rsp + 0x50]
mov ecx, 0x622
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x18f0]
mov rax, qword [0x140575740]
xor rax, rsp
mov qword [rsp + 0x18c0], rax
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x604], 0
mov eax, dword [rsp + 0x18f0]
inc eax
cdqe
shl rax, 3
mov ecx, 0xffffffff
cmp rax, rcx
jae 0x140197093
mov eax, dword [rsp + 0x18f0]
inc eax
cdqe
shl rax, 3
mov ecx, 0xffffffff
sub rcx, rax
mov rax, rcx
test rax, rax
jbe 0x140197093
mov eax, dword [rsp + 0x18f0]
inc eax
cdqe
shl rax, 3
mov ecx, 0xffffffe7
cmp rax, rcx
jae 0x140197093
xor eax, eax
cmp eax, 1
je 0x140197093
mov eax, dword [rsp + 0x18f0]
inc eax
cdqe
lea rax, [rax*8 + 0x18]
mov rcx, rax
call fcn.1403c4e30
mov qword [rsp + 0x1890], rax
jmp 0x14019709f
mov qword [rsp + 0x1890], 0
mov eax, dword [rsp + 0x18f0]
inc eax
cdqe
shl rax, 3
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x1890]
call fcn.1401375b0
mov qword [rsp + 0x620], rax
mov dword [rsp + 0x614], 0
jmp 0x1401970e9
mov eax, dword [rsp + 0x614]
inc eax
mov dword [rsp + 0x614], eax
mov eax, dword [rsp + 0x18f0]
cmp dword [rsp + 0x614], eax
jge 0x140197250
movsxd rax, dword [rsp + 0x614]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov rcx, qword [rsp + 0x18f8]
mov r8, qword [rcx + rax*8]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rsp + 0x618], eax
movsxd rax, dword [rsp + 0x618]
mov ecx, 0xffffffff
cmp rax, rcx
jae 0x1401971af
movsxd rax, dword [rsp + 0x618]
mov ecx, 0xffffffff
sub rcx, rax
mov rax, rcx
test rax, rax
jbe 0x1401971af
movsxd rax, dword [rsp + 0x618]
mov ecx, 0xffffffe7
cmp rax, rcx
jae 0x1401971af
xor eax, eax
cmp eax, 1
je 0x1401971af
movsxd rax, dword [rsp + 0x618]
add rax, 0x18
mov rcx, rax
call fcn.1403c4e30
mov qword [rsp + 0x1898], rax
jmp 0x1401971bb
mov qword [rsp + 0x1898], 0
movsxd rax, dword [rsp + 0x618]
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x1898]
call fcn.1401375b0
movsxd rcx, dword [rsp + 0x614]
mov rdx, qword [rsp + 0x620]
mov qword [rdx + rcx*8], rax
movsxd rax, dword [rsp + 0x614]
movsxd rcx, dword [rsp + 0x614]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov edx, dword [rsp + 0x618]
mov dword [rsp + 0x28], edx
mov rdx, qword [rsp + 0x620]
mov rax, qword [rdx + rax*8]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov rax, qword [rsp + 0x18f8]
mov r8, qword [rax + rcx*8]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop
jmp 0x1401970d9
cmp dword [rsp + 0x18f0], 1
jle 0x140197416
mov eax, 8
imul rax, rax, 1
lea rdx, str._finstall
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
je 0x140197371
mov eax, 8
imul rax, rax, 1
lea rdx, str._funinstall
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
je 0x140197371
mov eax, 8
imul rax, rax, 1
lea rdx, str._fulluninstall
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
je 0x140197371
mov eax, 8
imul rax, rax, 1
lea rdx, str._fullinstall
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
je 0x140197371
mov eax, 8
imul rax, rax, 1
lea rdx, str._install
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
je 0x140197371
mov eax, 8
imul rax, rax, 1
lea rdx, str._uninstall
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
je 0x140197371
mov eax, 8
imul rax, rax, 1
lea rdx, str._state
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x140197416
mov eax, 8
imul rax, rax, 1
movsxd rcx, dword [rsp + 0x18f0]
mov rdx, qword [rsp + 0x620]
mov r8, qword [rsp + 0x620]
mov rax, qword [r8 + rax]
mov qword [rdx + rcx*8], rax
mov ecx, 0x1c
call fcn.1403c4e30
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, rax
call fcn.1401375b0
mov ecx, 8
imul rcx, rcx, 1
mov rdx, qword [rsp + 0x620]
mov qword [rdx + rcx], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x620]
mov rax, qword [rcx + rax]
mov ecx, 8
imul rcx, rcx, 1
lea r8, [0x14056ed8c]
mov rdx, qword [rax - 0x18]
mov rax, qword [rsp + 0x620]
mov rcx, qword [rax + rcx]
call fcn.140015f80
mov eax, dword [rsp + 0x18f0]
inc eax
mov dword [rsp + 0x18f0], eax
cmp dword [rsp + 0x18f0], 1
jle 0x14019777e
mov eax, 8
imul rax, rax, 1
lea rdx, str._licenses
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x14019777e
lea rcx, [0x14056eda0]
call fcn.140015e70
lea rcx, str._MeshCentral_MeshAgent:_Copyright_2006___2022_Intel_Corporation_n
call fcn.140015e70
lea rcx, str.________________________https:__github.com_Ylianst_MeshAgent__n
call fcn.140015e70
lea rcx, [0x14056ee90]
call fcn.140015e70
lea rcx, str.___Licensed_under_the_Apache_License__Version_2.0__the__License____n
call fcn.140015e70
lea rcx, str.___you_may_not_use_this_file_except_in_compliance_with_the_License._n
call fcn.140015e70
lea rcx, str.___You_may_obtain_a_copy_of_the_License_at_n
call fcn.140015e70
lea rcx, [0x14056efb4]
call fcn.140015e70
lea rcx, str.___http:__www.apache.org_licenses_LICENSE_2.0_n
call fcn.140015e70
lea rcx, [0x14056eff0]
call fcn.140015e70
lea rcx, str.___Unless_required_by_applicable_law_or_agreed_to_in_writing__software_n
call fcn.140015e70
lea rcx, str.___distributed_under_the_License_is_distributed_on_an__AS_IS__BASIS__n
call fcn.140015e70
lea rcx, str.___WITHOUT_WARRANTIES_OR_CONDITIONS_OF_ANY_KIND__either_express_or_implied._n
call fcn.140015e70
lea rcx, str.___See_the_License_for_the_specific_language_governing_permissions_and_n
call fcn.140015e70
lea rcx, str.___limitations_under_the_License._n_n
call fcn.140015e70
lea rcx, [0x14056f160]
call fcn.140015e70
lea rcx, str._Duktape_Javascript_Engine:_Copyright__c__2013_2019_by_Duktape_authors__see_AUTHORS.rst__n
call fcn.140015e70
lea rcx, str.________________________https:__github.com_svaarala_duktape__n
call fcn.140015e70
lea rcx, str.________________________http:__opensource.org_licenses_MIT__n
call fcn.140015e70
lea rcx, [0x14056f2a0]
call fcn.140015e70
lea rcx, str.___Permission_is_hereby_granted__free_of_charge__to_any_person_obtaining_a_copy_n
call fcn.140015e70
lea rcx, str.___of_this_software_and_associated_documentation_files_the__Software____to_deal_n
call fcn.140015e70
lea rcx, str.___in_the_Software_without_restriction__including_without_limitation_the_rights_n
call fcn.140015e70
lea rcx, str.___to_use__copy__modify__merge__publish__distribute__sublicense__and___or_sell_n
call fcn.140015e70
lea rcx, str.___copies_of_the_Software__and_to_permit_persons_to_whom_the_Software_is_n
call fcn.140015e70
lea rcx, str.___furnished_to_do_so__subject_to_the_following_conditions_:_n
call fcn.140015e70
lea rcx, [0x14056f500]
call fcn.140015e70
lea rcx, str.___The_above_copyright_notice_and_this_permission_notice_shall_be_included_in_n
call fcn.140015e70
lea rcx, str.___all_copies_or_substantial_portions_of_the_Software._n
call fcn.140015e70
lea rcx, str.____n
call fcn.140015e70
lea rcx, str.___THE_SOFTWARE_IS_PROVIDED__AS_IS___WITHOUT_WARRANTY_OF_ANY_KIND__EXPRESS_OR_n
call fcn.140015e70
lea rcx, str.___IMPLIED__INCLUDING_BUT_NOT_LIMITED_TO_THE_WARRANTIES_OF_MERCHANTABILITY__n
call fcn.140015e70
lea rcx, str.___FITNESS_FOR_A_PARTICULAR_PURPOSE_AND_NONINFRINGEMENT.IN_NO_EVENT_SHALL_THE_n
call fcn.140015e70
lea rcx, str.___AUTHORS_OR_COPYRIGHT_HOLDERS_BE_LIABLE_FOR_ANY_CLAIM__DAMAGES_OR_OTHER_n
call fcn.140015e70
lea rcx, str.___LIABILITY__WHETHER_IN_AN_ACTION_OF_CONTRACT__TORT_OR_OTHERWISE__ARISING_FROM__n
call fcn.140015e70
lea rcx, str.___OUT_OF_OR_IN_CONNECTION_WITH_THE_SOFTWARE_OR_THE_USE_OR_OTHER_DEALINGS_IN_n
call fcn.140015e70
lea rcx, str.___THE_SOFTWARE._n
call fcn.140015e70
lea rcx, str._n
call fcn.140015e70
lea rcx, str.ZLIB_Data_Compression_Library:_Copyright__c__1995_2017_Jean_loup_Gailly_and_Mark_Adler_n
call fcn.140015e70
lea rcx, str._______________________________http:__www.zlib.net__n
call fcn.140015e70
lea rcx, str._________________________________________________________________________________________n
call fcn.140015e70
lea rcx, str.___This_software_is_provided_as_is__without_any_express_or_implied_n
call fcn.140015e70
lea rcx, str.___warranty.In_no_event_will_the_authors_be_held_liable_for_any_damages_n
call fcn.140015e70
lea rcx, str.___arising_from_the_use_of_this_software._n
call fcn.140015e70
lea rcx, reloc.WS2_32.dll_ioctlsocket
call fcn.140015e70
lea rcx, str.___Permission_is_granted_to_anyone_to_use_this_software_for_any_purpose__n
call fcn.140015e70
lea rcx, str.___including_commercial_applications__and_to_alter_it_and_redistribute_it_n
call fcn.140015e70
lea rcx, str.___freely__subject_to_the_following_restrictions_:_n
call fcn.140015e70
lea rcx, reloc.WS2_32.dll_ioctlsocket
call fcn.140015e70
lea rcx, str.___1._The_origin_of_this_software_must_not_be_misrepresented__you_must_not_n
call fcn.140015e70
lea rcx, str.______claim_that_you_wrote_the_original_software.If_you_use_this_software_n
call fcn.140015e70
lea rcx, str.______in_a_product__an_acknowledgment_in_the_product_documentation_would_be_n
call fcn.140015e70
lea rcx, str.______appreciated_but_is_not_required._n
call fcn.140015e70
lea rcx, str.___2._Altered_source_versions_must_be_plainly_marked_as_such__and_must_not_be_n
call fcn.140015e70
lea rcx, str.______misrepresented_as_being_the_original_software._n
call fcn.140015e70
lea rcx, str.___3._This_notice_may_not_be_removed_or_altered_from_any_source_distribution._n
call fcn.140015e70
lea rcx, reloc.WS2_32.dll_ioctlsocket
call fcn.140015e70
lea rcx, str.___Jean___loup_Gailly________Mark_Adler_n
call fcn.140015e70
lea rcx, str.___jloup_gzip.org____________madler_alumni.caltech.edu_n
call fcn.140015e70
nop
mov dword [rsp + 0x614], 0
jmp 0x14019772f
mov eax, dword [rsp + 0x614]
inc eax
mov dword [rsp + 0x614], eax
xor edx, edx
mov rax, qword [rsp + 0x620]
mov rax, qword [rax - 0x18]
mov ecx, 8
div rcx
cmp dword [rsp + 0x614], eax
jge 0x14019776a
movsxd rax, dword [rsp + 0x614]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax*8]
call fcn.140137da0
nop
jmp 0x14019771f
mov rcx, qword [rsp + 0x620]
call fcn.140137da0
xor eax, eax
jmp 0x140199cab
mov qword [rsp + 0x638], 0
mov dword [rsp + 0x654], 0
cmp dword [rsp + 0x18f0], 1
jle 0x14019787c
mov eax, 8
imul rax, rax, 1
lea rdx, str._info
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x14019787c
lea r8, str.Jul__9_2024
lea rdx, str.16:17:03
lea rcx, str.Compiled_on:__s___s_n
call fcn.140015e70
xor eax, eax
cmp eax, 1
je 0x140197814
lea rdx, str.ca52306f87407a122fac70723bfa025b9c422ae6
lea rcx, str.___Commit_Hash:__s_n
call fcn.140015e70
lea rdx, [0x14056fda8]
lea rcx, str.___Commit_Date:__s_n
call fcn.140015e70
nop
xor ecx, ecx
call fcn.1401caec0
mov rdx, rax
lea rcx, str.Using__s_n
call fcn.140015e70
mov edx, 4
lea rcx, str.Agent_ARCHID:__d_n
call fcn.140015e70
lea rax, [rsp + 0x680]
lea rcx, str.var__tmp__Detected_OS:___require_os_.Name__try_tmp________require_os_.arch____catch_x_console.log__tmp__if_process.platformwin32___tmprequire_win_authenticode_opus__process.execPath___if__tmp_null___tmp.url_null___tmprequire_win_authenticode_opus_.locked__tmp.url___if__tmp_null___console.log_LOCKED_to:____tmp.dns___console.log_______tmp.id______process.exit___
mov rdi, rax
mov rsi, rcx
mov ecx, 0x198
rep movsb byte [rdi], byte [rsi]
mov edx, 0x197
lea rcx, [rsp + 0x680]
call fcn.140144c90
mov qword [rsp + 0x638], rax
mov dword [rsp + 0x654], 0x197
cmp dword [rsp + 0x18f0], 2
jle 0x140197988
mov eax, 8
imul rax, rax, 1
lea rdx, str._faddr
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x140197988
mov qword [rsp + 0x838], 0
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x620]
mov rax, qword [rcx + rax]
add rax, 2
lea r8, [rsp + 0x838]
lea rdx, str._016llx
mov rcx, rax
call fcn.14001b890
mov r8, qword [rsp + 0x838]
mov edx, 0x1000
lea rcx, [0x14058a640]
call fcn.14014c8f0
lea rdx, [0x14058a640]
lea rcx, [0x14056ffb8]
call fcn.140015e70
nop
mov dword [rsp + 0x614], 0
jmp 0x140197939
mov eax, dword [rsp + 0x614]
inc eax
mov dword [rsp + 0x614], eax
xor edx, edx
mov rax, qword [rsp + 0x620]
mov rax, qword [rax - 0x18]
mov ecx, 8
div rcx
cmp dword [rsp + 0x614], eax
jge 0x140197974
movsxd rax, dword [rsp + 0x614]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax*8]
call fcn.140137da0
nop
jmp 0x140197929
mov rcx, qword [rsp + 0x620]
call fcn.140137da0
xor eax, eax
jmp 0x140199cab
cmp dword [rsp + 0x18f0], 2
jle 0x140197a8d
mov eax, 8
imul rax, rax, 1
lea rdx, str._fdelta
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x140197a8d
mov qword [rsp + 0x858], 0
mov eax, 8
imul rax, rax, 2
lea r8, [rsp + 0x858]
lea rdx, str._lld
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14001b890
mov r8, qword [rsp + 0x858]
mov edx, 0x1000
lea rcx, [0x14058a640]
call fcn.14014c8b0
lea rdx, [0x14058a640]
lea rcx, [0x14056ffd0]
call fcn.140015e70
nop
mov dword [rsp + 0x614], 0
jmp 0x140197a3e
mov eax, dword [rsp + 0x614]
inc eax
mov dword [rsp + 0x614], eax
xor edx, edx
mov rax, qword [rsp + 0x620]
mov rax, qword [rax - 0x18]
mov ecx, 8
div rcx
cmp dword [rsp + 0x614], eax
jge 0x140197a79
movsxd rax, dword [rsp + 0x614]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax*8]
call fcn.140137da0
nop
jmp 0x140197a2e
mov rcx, qword [rsp + 0x620]
call fcn.140137da0
xor eax, eax
jmp 0x140199cab
cmp qword [rsp + 0x638], 0
je 0x140197aa2
cmp dword [rsp + 0x654], 0
jne 0x140197ab8
lea rdx, [rsp + 0x654]
lea rcx, [rsp + 0x638]
call fcn.140117300
nop
cmp dword [rsp + 0x18f0], 1
jle 0x140197b20
mov eax, 8
imul rax, rax, 1
lea rdx, str._export
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038a9d0
test eax, eax
jne 0x140197b20
cmp dword [rsp + 0x654], 0
jne 0x140197b20
xor edx, edx
lea rcx, str.require_code_utils_.expand_embedded:_true__process.exit___
call fcn.140144c90
mov qword [rsp + 0x638], rax
mov edx, 0x1000
mov rcx, qword [rsp + 0x638]
call fcn.140193f70
mov dword [rsp + 0x654], eax
cmp dword [rsp + 0x18f0], 1
jle 0x140197b88
mov eax, 8
imul rax, rax, 1
lea rdx, str._import
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038a9d0
test eax, eax
jne 0x140197b88
cmp dword [rsp + 0x654], 0
jne 0x140197b88
xor edx, edx
lea rcx, str.require_code_utils_.shrink___process.exit___
call fcn.140144c90
mov qword [rsp + 0x638], rax
mov edx, 0x1000
mov rcx, qword [rsp + 0x638]
call fcn.140193f70
mov dword [rsp + 0x654], eax
cmp dword [rsp + 0x18f0], 2
jle 0x140197bfe
mov eax, 8
imul rax, rax, 1
lea rdx, str._exec
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038a9d0
test eax, eax
jne 0x140197bfe
cmp dword [rsp + 0x654], 0
jne 0x140197bfe
mov eax, 8
imul rax, rax, 2
xor edx, edx
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.140144c90
mov qword [rsp + 0x638], rax
mov edx, 0x1000
mov rcx, qword [rsp + 0x638]
call fcn.140193f70
mov dword [rsp + 0x654], eax
cmp dword [rsp + 0x18f0], 2
jle 0x140197c81
mov eax, 8
imul rax, rax, 1
lea rdx, str._b64exec
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038a9d0
test eax, eax
jne 0x140197c81
cmp dword [rsp + 0x654], 0
jne 0x140197c81
mov eax, 8
imul rax, rax, 2
mov edx, 0x10000
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.140193f70
mov ecx, 8
imul rcx, rcx, 2
lea r8, [rsp + 0x638]
mov edx, eax
mov rax, qword [rsp + 0x620]
mov rcx, qword [rax + rcx]
call fcn.140147580
mov dword [rsp + 0x654], eax
cmp dword [rsp + 0x18f0], 1
jle 0x140197cf1
mov eax, 8
imul rax, rax, 1
lea rdx, str._nodeid
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x140197cf1
lea rax, [rsp + 0x878]
lea rcx, str.console.log_require__agentNodeId_____process.exit___
mov rdi, rax
mov rsi, rcx
mov ecx, gethostname
rep movsb byte [rdi], byte [rsi]
mov edx, gethostname
lea rcx, [rsp + 0x878]
call fcn.140144c90
mov qword [rsp + 0x638], rax
mov dword [rsp + 0x654], 0x36
cmp dword [rsp + 0x18f0], 1
jle 0x140197d61
mov eax, 8
imul rax, rax, 1
lea rdx, str._name
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x140197d61
lea rax, [rsp + 0x8d0]
lea rcx, str.console.log_require__agentNodeId_.serviceName____process.exit___
mov rdi, rax
mov rsi, rcx
mov ecx, 0x43
rep movsb byte [rdi], byte [rsi]
mov edx, 0x42
lea rcx, [rsp + 0x8d0]
call fcn.140144c90
mov qword [rsp + 0x638], rax
mov dword [rsp + 0x654], 0x42
cmp dword [rsp + 0x18f0], 1
jle 0x140197dd1
mov eax, 8
imul rax, rax, 1
lea rdx, str.exstate
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x140197dd1
lea rax, [rsp + 0x940]
lea rcx, str.var_rrawState:__1__state:_NOT_INSTALLED_tryrrequire_service_manager_.manager.getService_require__agentNodeId_.serviceName___.status_catch_z__console.log_r.state__process.exit_r.rawState__
mov rdi, rax
mov rsi, rcx
mov ecx, 0xca
rep movsb byte [rdi], byte [rsi]
mov edx, 0xc9
lea rcx, [rsp + 0x940]
call fcn.140144c90
mov qword [rsp + 0x638], rax
mov dword [rsp + 0x654], 0xc9
cmp dword [rsp + 0x18f0], 1
jle 0x140197e41
mov eax, 8
imul rax, rax, 1
lea rdx, str.state
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x140197e41
lea rax, [rsp + 0xa30]
lea rcx, str.tryconsole.log_require_service_manager_.manager.getService_require__agentNodeId_.serviceName___.status.state__catch_z_console.log_NOT_INSTALLED___process.exit___
mov rdi, rax
mov rsi, rcx
mov ecx, 0xac
rep movsb byte [rdi], byte [rsi]
mov edx, 0xab
lea rcx, [rsp + 0xa30]
call fcn.140144c90
mov qword [rsp + 0x638], rax
mov dword [rsp + 0x654], 0xab
cmp dword [rsp + 0x18f0], 1
jle 0x140197eda
mov eax, 8
imul rax, rax, 1
lea rdx, str.start
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
je 0x140197e99
mov eax, 8
imul rax, rax, 1
lea rdx, [0x1405702a4]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x140197eda
lea rax, [rsp + 0xb00]
lea rcx, str.tryrequire_service_manager_.manager.getService_require__agentNodeId_.serviceName___.start___console.log_Service_Started__catch_z_console.log_Failed_to_start_service__process.exit___
mov rdi, rax
mov rsi, rcx
mov ecx, 0xc2
rep movsb byte [rdi], byte [rsi]
mov edx, 0xc1
lea rcx, [rsp + 0xb00]
call fcn.140144c90
mov qword [rsp + 0x638], rax
mov dword [rsp + 0x654], 0xc1
cmp dword [rsp + 0x18f0], 1
jle 0x140197f73
mov eax, 8
imul rax, rax, 1
lea rdx, str.stop
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
je 0x140197f32
mov eax, 8
imul rax, rax, 1
lea rdx, str._stop
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x140197f73
lea rax, [rsp + 0xbf0]
lea rcx, str.tryrequire_service_manager_.manager.getService_require__agentNodeId_.serviceName___.stop__.then_function_m_console.log_Service_Stopped__process.exit_____function_m_console.log_m__process.exit_____catch_z_console.log_Failed_to_stop_service__process.exit___
mov rdi, rax
mov rsi, rcx
mov ecx, 0x110
rep movsb byte [rdi], byte [rsi]
mov edx, 0x10f
lea rcx, [rsp + 0xbf0]
call fcn.140144c90
mov qword [rsp + 0x638], rax
mov dword [rsp + 0x654], 0x10f
cmp dword [rsp + 0x18f0], 1
jle 0x14019800c
mov eax, 8
imul rax, rax, 1
lea rdx, str.restart
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
je 0x140197fcb
mov eax, 8
imul rax, rax, 1
lea rdx, str._restart
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x14019800c
lea rax, [rsp + 0xd20]
lea rcx, str.tryrequire_service_manager_.manager.getService_require__agentNodeId_.serviceName___.restart__.then_function_m_console.log_Service_Restarted__process.exit_____function_m_console.log_m__process.exit_____catch_z_console.log_Failed_to_restart_service__process.exit___
mov rdi, rax
mov rsi, rcx
mov ecx, 0x118
rep movsb byte [rdi], byte [rsi]
mov edx, 0x117
lea rcx, [rsp + 0xd20]
call fcn.140144c90
mov qword [rsp + 0x638], rax
mov dword [rsp + 0x654], 0x117
cmp dword [rsp + 0x18f0], 1
jle 0x140198086
mov eax, 8
imul rax, rax, 1
lea rdx, str._agentHash
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x140198086
cmp dword [rsp + 0x654], 0
jne 0x140198086
lea rax, [rsp + 0xe60]
lea rcx, str.console.log_getSHA384FileHash_process.execPath_.toString_hex_.substring_0_16___process.exit___
mov rdi, rax
mov rsi, rcx
mov ecx, 0x61
rep movsb byte [rdi], byte [rsi]
mov edx, 0x60
lea rcx, [rsp + 0xe60]
call fcn.140144c90
mov qword [rsp + 0x638], rax
mov dword [rsp + 0x654], 0x60
cmp dword [rsp + 0x18f0], 1
jle 0x140198100
mov eax, 8
imul rax, rax, 1
lea rdx, str._agentFullHash
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x140198100
cmp dword [rsp + 0x654], 0
jne 0x140198100
lea rax, [rsp + 0xef0]
lea rcx, str.console.log_getSHA384FileHash_process.execPath_.toString_hex___process.exit___
mov rdi, rax
mov rsi, rcx
mov ecx, 0x51
rep movsb byte [rdi], byte [rsi]
mov edx, 0x50
lea rcx, [rsp + 0xef0]
call fcn.140144c90
mov qword [rsp + 0x638], rax
mov dword [rsp + 0x654], 0x50
cmp dword [rsp + 0x18f0], 2
jne 0x140198170
mov eax, 8
imul rax, rax, 1
lea rdx, str._resetnodeid
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x140198170
lea rax, [rsp + 0xf70]
lea rcx, str.tryrequire__agentNodeId_.resetNodeId___catch_z_console.log_This_command_requires_admin.__process.exit___
mov rdi, rax
mov rsi, rcx
mov ecx, WSAStartup
rep movsb byte [rdi], byte [rsi]
mov edx, reloc.WS2_32.dll_WSASetLastError
lea rcx, [rsp + 0xf70]
call fcn.140144c90
mov qword [rsp + 0x638], rax
mov dword [rsp + 0x654], 0x70
cmp dword [rsp + 0x18f0], 1
jle 0x1401981e0
mov eax, 8
imul rax, rax, 1
lea rdx, str._setfirewall
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x1401981e0
lea rax, [rsp + 0x1008]
lea rcx, str.require_agent_installer_.setfirewall___
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2a
rep movsb byte [rdi], byte [rsi]
mov edx, 0x29
lea rcx, [rsp + 0x1008]
call fcn.140144c90
mov qword [rsp + 0x638], rax
mov dword [rsp + 0x654], 0x29
cmp dword [rsp + 0x18f0], 1
jle 0x140198250
mov eax, 8
imul rax, rax, 1
lea rdx, str._clearfirewall
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x140198250
lea rax, [rsp + 0x1058]
lea rcx, str.require_agent_installer_.clearfirewall___
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2c
rep movsb byte [rdi], byte [rsi]
mov edx, 0x2b
lea rcx, [rsp + 0x1058]
call fcn.140144c90
mov qword [rsp + 0x638], rax
mov dword [rsp + 0x654], 0x2b
cmp dword [rsp + 0x18f0], 1
jle 0x1401982c0
mov eax, 8
imul rax, rax, 1
lea rdx, str._checkfirewall
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x1401982c0
lea rax, [rsp + 0x10a8]
lea rcx, str.require_agent_installer_.checkfirewall___
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2c
rep movsb byte [rdi], byte [rsi]
mov edx, 0x2b
lea rcx, [rsp + 0x10a8]
call fcn.140144c90
mov qword [rsp + 0x638], rax
mov dword [rsp + 0x654], 0x2b
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
cmp dword [rsp + 0x18f0], 1
jle 0x1401983a0
mov eax, 8
imul rax, rax, 1
lea rdx, str._updaterversion
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x1401983a0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x10f4]
mov r8d, 2
lea rdx, [0x140570828]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov dword [rsp + 0x614], 0
jmp 0x140198351
mov eax, dword [rsp + 0x614]
inc eax
mov dword [rsp + 0x614], eax
xor edx, edx
mov rax, qword [rsp + 0x620]
mov rax, qword [rax - 0x18]
mov ecx, 8
div rcx
cmp dword [rsp + 0x614], eax
jge 0x14019838c
movsxd rax, dword [rsp + 0x614]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax*8]
call fcn.140137da0
nop
jmp 0x140198341
mov rcx, qword [rsp + 0x620]
call fcn.140137da0
xor eax, eax
jmp 0x140199cab
cmp dword [rsp + 0x18f0], 1
jle 0x14019863c
mov eax, 8
imul rax, rax, 1
lea rdx, str._kvm0
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x14019863c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x20
call fcn.140138010
mov qword [rsp + 0x1108], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x1108]
lea rdx, [0x140196d80]
mov qword [rcx + rax], rdx
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x1108]
add rcx, rax
mov rax, rcx
mov ecx, 4
imul rcx, rcx, 0
mov dword [rax + rcx], 0
cmp dword [rsp + 0x18f0], 2
jle 0x140198470
mov eax, 8
imul rax, rax, 2
lea rdx, [0x140570838]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x140198470
mov dword [rsp + 0x18a0], 1
jmp 0x14019847b
mov dword [rsp + 0x18a0], 0
mov eax, 8
imul rax, rax, 3
mov rcx, qword [rsp + 0x1108]
add rcx, rax
mov rax, rcx
mov ecx, 4
imul rcx, rcx, 0
mov edx, dword [rsp + 0x18a0]
mov dword [rax + rcx], edx
cmp dword [rsp + 0x18f0], 2
jle 0x1401984d4
mov eax, 8
imul rax, rax, 2
lea rdx, [0x140570848]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
je 0x140198503
cmp dword [rsp + 0x18f0], 3
jle 0x14019850d
mov eax, 8
imul rax, rax, 3
lea rdx, [0x140570858]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x14019850d
mov dword [0x140576564], 1
mov r8d, 0x800
xor edx, edx
lea rcx, [0x140570868]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x1110], rax
mov qword [rsp + 0x1118], 0
cmp qword [rsp + 0x1110], 0
je 0x140198583
lea rdx, [0x140570878]
mov rcx, qword [rsp + 0x1110]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x1118], rax
cmp qword [rsp + 0x1118], 0
jne 0x140198583
mov rcx, qword [rsp + 0x1110]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x1110], 0
cmp qword [rsp + 0x1118], 0
je 0x1401985b6
mov ecx, 2
call qword [rsp + 0x1118]
mov rcx, qword [rsp + 0x1110]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x1110], 0
jmp 0x1401985bd
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
nop
mov rcx, qword [rsp + 0x1108]
call fcn.14001b2b0
nop
mov dword [rsp + 0x614], 0
jmp 0x1401985e8
mov eax, dword [rsp + 0x614]
inc eax
mov dword [rsp + 0x614], eax
xor edx, edx
mov rax, qword [rsp + 0x620]
mov rax, qword [rax - 0x18]
mov ecx, 8
div rcx
cmp dword [rsp + 0x614], eax
jge 0x140198623
movsxd rax, dword [rsp + 0x614]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax*8]
call fcn.140137da0
nop
jmp 0x1401985d8
mov rcx, qword [rsp + 0x620]
call fcn.140137da0
xor eax, eax
jmp 0x140199cab
cmp dword [rsp + 0x18f0], 1
jle 0x1401988d3
mov eax, 8
imul rax, rax, 1
lea rdx, str._kvm1
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x1401988d3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x20
call fcn.140138010
mov qword [rsp + 0x1120], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x1120]
lea rdx, [0x140196d80]
mov qword [rcx + rax], rdx
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x1120]
add rcx, rax
mov rax, rcx
mov ecx, 4
imul rcx, rcx, 0
mov dword [rax + rcx], 1
cmp dword [rsp + 0x18f0], 2
jle 0x14019870c
mov eax, 8
imul rax, rax, 2
lea rdx, str._coredump
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x14019870c
mov dword [rsp + 0x18a4], 1
jmp 0x140198717
mov dword [rsp + 0x18a4], 0
mov eax, 8
imul rax, rax, 3
mov rcx, qword [rsp + 0x1120]
add rcx, rax
mov rax, rcx
mov ecx, 4
imul rcx, rcx, 0
mov edx, dword [rsp + 0x18a4]
mov dword [rax + rcx], edx
cmp dword [rsp + 0x18f0], 2
jle 0x140198770
mov eax, 8
imul rax, rax, 2
lea rdx, [0x1405708a8]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
je 0x14019879f
cmp dword [rsp + 0x18f0], 3
jle 0x1401987a9
mov eax, 8
imul rax, rax, 3
lea rdx, str._remotecursor
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x1401987a9
mov dword [0x140576564], 1
mov r8d, 0x800
xor edx, edx
lea rcx, str.Shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x1128], rax
mov qword [rsp + 0x1130], 0
cmp qword [rsp + 0x1128], 0
je 0x14019881f
lea rdx, str.SetProcessDpiAwareness
mov rcx, qword [rsp + 0x1128]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x1130], rax
cmp qword [rsp + 0x1130], 0
jne 0x14019881f
mov rcx, qword [rsp + 0x1128]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x1128], 0
cmp qword [rsp + 0x1130], 0
je 0x140198852
mov ecx, 2
call qword [rsp + 0x1130]
mov rcx, qword [rsp + 0x1128]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x1128], 0
jmp 0x140198859
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
nop
mov rcx, qword [rsp + 0x1120]
call fcn.14001b2b0
nop
mov dword [rsp + 0x614], 0
jmp 0x140198884
mov eax, dword [rsp + 0x614]
inc eax
mov dword [rsp + 0x614], eax
xor edx, edx
mov rax, qword [rsp + 0x620]
mov rax, qword [rax - 0x18]
mov ecx, 8
div rcx
cmp dword [rsp + 0x614], eax
jge 0x1401988bf
movsxd rax, dword [rsp + 0x614]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax*8]
call fcn.140137da0
nop
jmp 0x140198874
mov rcx, qword [rsp + 0x620]
call fcn.140137da0
xor eax, eax
jmp 0x140199cab
cmp qword [rsp + 0x638], 0
jne 0x140198996
cmp dword [rsp + 0x18f0], 0
jle 0x140198915
mov eax, 8
imul rax, rax, 0
lea rdx, [0x1405708f0]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
je 0x140198996
cmp dword [rsp + 0x18f0], 1
jle 0x140198b5e
mov eax, 8
imul rax, rax, 1
lea rdx, [0x1405708f8]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
je 0x140198996
mov eax, 8
imul rax, rax, 1
lea rdx, [0x140570900]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
je 0x140198996
mov eax, 8
imul rax, rax, 1
lea rdx, str.__slave
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x140198b5e
mov edx, 1
lea rcx, [0x140196e00]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop
mov dword [rsp + 0x1138], 0
cmp dword [rsp + 0x18f0], 1
jle 0x1401989ee
mov eax, 8
imul rax, rax, 1
lea rdx, [0x140570910]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x1401989ee
mov dword [rsp + 0x1138], 0x20
mov ecx, dword [rsp + 0x1138]
call fcn.1400011e0
mov qword [0x140577358], rax
mov rax, qword [0x140577358]
mov rcx, qword [rsp + 0x638]
mov qword [rax + 0x20], rcx
mov rax, qword [0x140577358]
mov ecx, dword [rsp + 0x654]
mov dword [rax + 0x28], ecx
cmp qword [rsp + 0x638], 0
jne 0x140198a84
cmp dword [rsp + 0x18f0], 1
jle 0x140198a95
mov eax, 8
imul rax, rax, 1
lea rdx, [0x140570918]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
je 0x140198a84
mov eax, 8
imul rax, rax, 1
lea rdx, [0x140570920]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x140198a95
mov rax, qword [0x140577358]
mov dword [rax + 0xdfc], 1
mov r8, qword [rsp + 0x620]
mov edx, dword [rsp + 0x18f0]
mov rcx, qword [0x140577358]
call fcn.140001690
mov rax, qword [0x140577358]
mov eax, dword [rax + 0xdb4]
mov dword [rsp + 0x604], eax
mov rcx, qword [0x140577358]
call fcn.1400014e0
mov qword [0x140577358], 0
jmp 0x140198ae8
mov dword [rsp + 0x614], 0
jmp 0x140198b05
mov eax, dword [rsp + 0x614]
inc eax
mov dword [rsp + 0x614], eax
xor edx, edx
mov rax, qword [rsp + 0x620]
mov rax, qword [rax - 0x18]
mov ecx, 8
div rcx
cmp dword [rsp + 0x614], eax
jge 0x140198b40
movsxd rax, dword [rsp + 0x614]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax*8]
call fcn.140137da0
nop
jmp 0x140198af5
mov rcx, qword [rsp + 0x620]
call fcn.140137da0
mov eax, dword [rsp + 0x604]
jmp 0x140199cab
cmp dword [rsp + 0x18f0], 1
jle 0x140198e43
mov eax, 8
imul rax, rax, 1
mov r8d, 8
lea rdx, str._update:
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.1404104c0
test eax, eax
jne 0x140198e43
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x400
call fcn.140138010
mov qword [rsp + 0x1140], rax
mov eax, 8
imul rax, rax, 1
mov ecx, 1
imul rcx, rcx, 8
mov rdx, qword [rsp + 0x620]
mov rax, qword [rdx + rax]
movsx eax, byte [rax + rcx]
cmp eax, 0x2a
jne 0x140198c99
cmp dword [rsp + 0x18f0], 2
jle 0x140198c09
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x620]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x18a8], rax
jmp 0x140198c18
lea rax, str.null
mov qword [rsp + 0x18a8], rax
mov eax, 8
imul rax, rax, 1
mov ecx, 1
imul rcx, rcx, 9
mov rdx, qword [rsp + 0x620]
mov rax, qword [rdx + rax]
movsx eax, byte [rax + rcx]
cmp eax, 0x53
jne 0x140198c50
lea rax, str.true
mov qword [rsp + 0x18b0], rax
jmp 0x140198c5f
lea rax, str.false
mov qword [rsp + 0x18b0], rax
mov rax, qword [rsp + 0x18a8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x18b0]
lea r8, str.require_agent_installer_.update__s___s__
mov edx, 0x400
mov rcx, qword [rsp + 0x1140]
call fcn.140015f80
mov dword [rsp + 0x1148], eax
jmp 0x140198d48
cmp dword [rsp + 0x18f0], 2
jle 0x140198d28
mov eax, 8
imul rax, rax, 2
lea rdx, [0x140570980]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038a9d0
test eax, eax
je 0x140198cf1
mov eax, 8
imul rax, rax, 2
lea rdx, [0x140570988]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038a9d0
test eax, eax
jne 0x140198d28
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x620]
mov r9, qword [rcx + rax]
lea r8, str.require_agent_installer_.update_false____s___
mov edx, 0x400
mov rcx, qword [rsp + 0x1140]
call fcn.140015f80
mov dword [rsp + 0x1148], eax
jmp 0x140198d48
lea r8, str.require_agent_installer_.update_true__
mov edx, 0x400
mov rcx, qword [rsp + 0x1140]
call fcn.140015f80
mov dword [rsp + 0x1148], eax
xor ecx, ecx
call fcn.1400011e0
mov qword [0x140577358], rax
mov rax, qword [0x140577358]
mov rcx, qword [rsp + 0x1140]
mov qword [rax + 0x20], rcx
mov rax, qword [0x140577358]
mov ecx, dword [rsp + 0x1148]
mov dword [rax + 0x28], ecx
mov r8, qword [rsp + 0x620]
mov edx, dword [rsp + 0x18f0]
mov rcx, qword [0x140577358]
call fcn.140001690
mov rax, qword [0x140577358]
mov eax, dword [rax + 0xdb4]
mov dword [rsp + 0x604], eax
mov rcx, qword [0x140577358]
call fcn.1400014e0
mov qword [0x140577358], 0
jmp 0x140198dcd
mov dword [rsp + 0x614], 0
jmp 0x140198dea
mov eax, dword [rsp + 0x614]
inc eax
mov dword [rsp + 0x614], eax
xor edx, edx
mov rax, qword [rsp + 0x620]
mov rax, qword [rax - 0x18]
mov ecx, 8
div rcx
cmp dword [rsp + 0x614], eax
jge 0x140198e25
movsxd rax, dword [rsp + 0x614]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax*8]
call fcn.140137da0
nop
jmp 0x140198dda
mov rcx, qword [rsp + 0x620]
call fcn.140137da0
mov eax, dword [rsp + 0x604]
jmp 0x140199cab
cmp dword [rsp + 0x18f0], 1
jle 0x140198ea3
mov eax, 8
imul rax, rax, 1
lea rdx, str._netinfo
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038ac90
test eax, eax
jne 0x140198ea3
lea rcx, [rsp + 0x1158]
call fcn.14001ddd0
mov dword [rsp + 0x1164], eax
cmp dword [rsp + 0x1164], 0
jle 0x140198e9e
mov rcx, qword [rsp + 0x1158]
call fcn.14019a3e0
nop
jmp 0x140199c3d
mov dword [rsp + 0x1168], 0
mov rdx, qword [rsp + 0x620]
mov ecx, dword [rsp + 0x18f0]
call fcn.140196bc0
test eax, eax
jne 0x140199c3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x427
jne 0x140199c3d
cmp dword [rsp + 0x18f0], 2
jl 0x140198fc3
mov eax, 8
imul rax, rax, 1
mov r9d, 3
lea r8, [0x140570a04]
mov rdx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.140144f20
test eax, eax
jne 0x140198f4d
mov eax, 8
imul rax, rax, 1
mov r9d, 4
lea r8, str..zip
mov rdx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.140144f20
test eax, eax
je 0x140198fc3
mov edx, 1
lea rcx, [0x140196e00]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop
xor ecx, ecx
call fcn.1400011e0
mov qword [0x140577358], rax
mov rax, qword [0x140577358]
mov dword [rax + 0xdfc], 1
mov r8, qword [rsp + 0x620]
mov edx, dword [rsp + 0x18f0]
mov rcx, qword [0x140577358]
call fcn.140001690
mov rcx, qword [0x140577358]
call fcn.1400014e0
mov qword [0x140577358], 0
jmp 0x140198fbe
jmp 0x140199c3d
cmp dword [rsp + 0x18f0], 2
jne 0x140199146
mov eax, 8
imul rax, rax, 1
lea rdx, [0x140570a10]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038a9d0
test eax, eax
jne 0x140199146
mov qword [rsp + 0x1170], 0
mov r8d, 0x104
lea rdx, [rsp + 0x12c0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r9d, 0x104
lea r8, [rsp + 0x1190]
mov edx, 0xffffffff
lea rcx, [rsp + 0x12c0]
call fcn.140137020
call fcn.14013c5d0
mov qword [rsp + 0x14d8], rax
mov rcx, qword [rsp + 0x14d8]
call fcn.14013f740
call fcn.140117cd0
mov rcx, qword [rsp + 0x14d8]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x1190]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x14d8]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140117de0
mov qword [rsp + 0x14e0], rax
mov r9d, 0xe88
xor r8d, r8d
lea rdx, str.require_util_language_.current.toUpperCase__.split___.join____
mov rcx, qword [rsp + 0x14e0]
call fcn.14003f390
test eax, eax
jne 0x140199109
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x14e0]
call fcn.14003ab50
mov qword [rsp + 0x1170], rax
mov rdx, qword [rsp + 0x1170]
lea rcx, str.Current_Language:__s_n
call fcn.140015e70
nop
mov rcx, qword [rsp + 0x14e0]
call fcn.1400e0900
mov rcx, qword [rsp + 0x14d8]
call fcn.1401403c0
mov rcx, qword [rsp + 0x14d8]
call fcn.14013f850
mov dword [rsp + 0x18f0], 1
mov dword [rsp + 0x1168], 1
cmp dword [rsp + 0x18f0], 2
jne 0x140199229
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038b0f0
cmp rax, 6
jbe 0x140199229
mov eax, 8
imul rax, rax, 1
mov r8d, 6
lea rdx, str._lang
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax]
call fcn.14038b1b0
test eax, eax
jne 0x140199229
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x620]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x18b8], rax
mov ecx, 8
imul rcx, rcx, 1
mov rdx, qword [rsp + 0x620]
mov rcx, qword [rdx + rcx]
call fcn.14038b0f0
mov ecx, 8
imul rcx, rcx, 1
mov r9d, 1
lea r8, [0x140570a88]
mov rdx, rax
mov rax, qword [rsp + 0x620]
mov rcx, qword [rax + rcx]
call fcn.140145290
cdqe
mov rcx, qword [rsp + 0x18b8]
lea rax, [rcx + rax + 1]
mov qword [0x140577360], rax
mov dword [rsp + 0x18f0], 1
cmp dword [rsp + 0x18f0], 1
je 0x14019932d
lea rcx, str.Mesh_Agent_available_switches:_r_n
call fcn.140015e70
lea rcx, str.__run_______________Start_as_a_console_agent._r_n
call fcn.140015e70
lea rcx, str.__connect___________Start_as_a_temporary_console_agent._r_n
call fcn.140015e70
lea rcx, str.__start_____________Start_the_service._r_n
call fcn.140015e70
lea rcx, str.__restart___________Restart_the_service._r_n
call fcn.140015e70
lea rcx, str.__stop______________Stop_the_service._r_n
call fcn.140015e70
lea rcx, str.__state_____________Display_the_running_state_of_the_service._r_n
call fcn.140015e70
lea rcx, str.___signcheck________Perform_self___check._r_n
call fcn.140015e70
lea rcx, str.___install__________Install_the_service_from_this_location._r_n
call fcn.140015e70
lea rcx, str.___uninstall________Remove_the_service_from_this_location._r_n
call fcn.140015e70
lea rcx, str.___nodeid___________Return_the_current_agent_identifier._r_n
call fcn.140015e70
lea rcx, str.___info_____________Return_agent_version_information._r_n
call fcn.140015e70
lea rcx, str.___resetnodeid______Reset_the_NodeID_next_time_the_service_is_started._r_n
call fcn.140015e70
lea rcx, str.___fulluninstall____Stop_agent_and_clean_up_the_program_files_location._r_n
call fcn.140015e70
lea rcx, str.___fullinstall______Copy_agent_into_program_files__install_and_launch._r_n
call fcn.140015e70
lea rcx, [0x140570e0c]
call fcn.140015e70
lea rcx, str.____________________The_following_switches_can_be_specified_after__fullinstall:_r_n
call fcn.140015e70
lea rcx, [0x140570e64]
call fcn.140015e70
lea rcx, str._______WebProxy_http:__proxyhost:port_______Specify_an_HTTPS_proxy._r_n
call fcn.140015e70
lea rcx, str._______agentName_alternate_name_____________Specify_an_alternate_name_to_be_provided_by_the_agent._r_n
call fcn.140015e70
nop
jmp 0x140199c3d
cmp dword [rsp + 0x1168], 0
jne 0x140199c3d
mov qword [rsp + 0x1618], 0
mov r8d, 0x104
lea rdx, [rsp + 0x1630]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r9d, 0x104
lea r8, [rsp + 0x1500]
mov edx, 0xffffffff
lea rcx, [rsp + 0x1630]
call fcn.140137020
call fcn.14013c5d0
mov qword [rsp + 0x1848], rax
mov rcx, qword [rsp + 0x1848]
call fcn.14013f740
call fcn.140117cd0
mov rcx, qword [rsp + 0x1848]
mov qword [rsp + 0x48], rcx
lea rcx, [0x140196e50]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x1500]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x1848]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140117de0
mov qword [rsp + 0x1850], rax
mov r9d, 0xe88
xor r8d, r8d
lea rdx, str.require_win_authenticode_opus_.checkMSH___
mov rcx, qword [rsp + 0x1850]
call fcn.14003f390
test eax, eax
jne 0x140199bfe
mov r9d, 0xe88
xor r8d, r8d
lea rdx, str.require_util_language_.current.toLowerCase__.split___.join____
mov rcx, qword [rsp + 0x1850]
call fcn.14003f390
test eax, eax
jne 0x14019945d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x1850]
call fcn.14003ab50
mov qword [rsp + 0x1618], rax
mov r9d, 0xe88
xor r8d, r8d
lea rdx, str._function_foo__return_JSON.parse__MSH__.translation______
mov rcx, qword [rsp + 0x1850]
call fcn.14003f390
test eax, eax
jne 0x14019949f
lea r8, [0x140570fe4]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x1850]
call fcn.14003c820
test eax, eax
jne 0x140199753
mov rcx, qword [rsp + 0x1850]
call fcn.140035af0
lea rdx, str.Install
mov rcx, qword [rsp + 0x1850]
call fcn.140035090
lea r8, [0x140570ff0]
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.14003c230
lea rdx, str.Uninstall
mov rcx, qword [rsp + 0x1850]
call fcn.140035090
lea r8, [0x140571008]
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.14003c230
lea rdx, str.Connect
mov rcx, qword [rsp + 0x1850]
call fcn.140035090
lea r8, [0x140571020]
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.14003c230
lea rdx, str.Disconnect
mov rcx, qword [rsp + 0x1850]
call fcn.140035090
lea r8, [0x140571038]
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.14003c230
lea rdx, str.Update
mov rcx, qword [rsp + 0x1850]
call fcn.140035090
lea r8, [0x14057104c]
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.14003c230
mov rcx, qword [rsp + 0x1850]
call fcn.140035b90
lea rdx, str.NOT_INSTALLED
mov rcx, qword [rsp + 0x1850]
call fcn.140035090
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.140033b50
lea r8, [0x140571068]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x1850]
call fcn.14003bf90
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.140033b00
mov edx, 0xfffffffd
mov rcx, qword [rsp + 0x1850]
call fcn.140033b50
mov edx, 1
mov rcx, qword [rsp + 0x1850]
call fcn.14003f030
mov rcx, qword [rsp + 0x1850]
call fcn.140036f80
lea rdx, str.RUNNING
mov rcx, qword [rsp + 0x1850]
call fcn.140035090
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.140033b50
lea r8, [0x140571078]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x1850]
call fcn.14003bf90
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.140033b00
mov edx, 0xfffffffd
mov rcx, qword [rsp + 0x1850]
call fcn.140033b50
mov edx, 1
mov rcx, qword [rsp + 0x1850]
call fcn.14003f030
mov rcx, qword [rsp + 0x1850]
call fcn.140036f80
lea rdx, str.NOT_RUNNING
mov rcx, qword [rsp + 0x1850]
call fcn.140035090
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.140033b50
lea r8, str.push
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x1850]
call fcn.14003bf90
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.140033b00
mov edx, 0xfffffffd
mov rcx, qword [rsp + 0x1850]
call fcn.140033b50
mov edx, 1
mov rcx, qword [rsp + 0x1850]
call fcn.14003f030
mov rcx, qword [rsp + 0x1850]
call fcn.140036f80
lea r8, [0x140571094]
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.14003c230
lea r8, [0x14057109c]
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.14003c230
nop
cmp qword [0x140577360], 0
je 0x14019976c
mov rax, qword [0x140577360]
mov qword [rsp + 0x1618], rax
mov r8, qword [rsp + 0x1618]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x1850]
call fcn.14003c820
test eax, eax
jne 0x140199882
mov rdx, qword [rsp + 0x1618]
mov rcx, qword [rsp + 0x1850]
call fcn.140035090
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x1850]
call fcn.140033b50
lea r8, str.split
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x1850]
call fcn.14003bf90
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.140033b00
lea rdx, [0x1405710a8]
mov rcx, qword [rsp + 0x1850]
call fcn.140035090
mov edx, 1
mov rcx, qword [rsp + 0x1850]
call fcn.14003ee60
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x1850]
call fcn.140033b50
lea r8, str.shift
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x1850]
call fcn.14003bf90
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.140033b00
xor edx, edx
mov rcx, qword [rsp + 0x1850]
call fcn.14003ee60
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x1850]
call fcn.14003ab50
mov qword [rsp + 0x1618], rax
mov edx, 0xfffffffc
mov rcx, qword [rsp + 0x1850]
call fcn.140033b50
nop
mov r8, qword [rsp + 0x1618]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x1850]
call fcn.14003c820
test eax, eax
jne 0x1401998af
lea rax, [0x1405710b4]
mov qword [rsp + 0x1618], rax
mov rdx, qword [rsp + 0x1618]
lea rcx, [0x1405710b8]
call fcn.14038a9d0
test eax, eax
je 0x140199991
lea r8, [0x1405710bc]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x1850]
call fcn.14003bf90
mov r8, qword [rsp + 0x1618]
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.14003bf90
mov r8d, reloc.WS2_32.dll_recv
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.14003e170
nop
mov r8d, 1
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x1850]
call fcn.14003e1e0
test eax, eax
je 0x140199983
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.140037eb0
mov r8, rax
mov edx, 0xfffffffc
mov rcx, qword [rsp + 0x1850]
call fcn.14003c820
test eax, eax
jne 0x140199973
mov edx, 0xfffffffc
mov rcx, qword [rsp + 0x1850]
call fcn.14003c1e0
nop
jmp 0x140199981
mov rcx, qword [rsp + 0x1850]
call fcn.140036f80
nop
jmp 0x140199917
mov rcx, qword [rsp + 0x1850]
call fcn.140037010
nop
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x1850]
call fcn.1400381b0
mov qword [0x140577380], rax
mov rax, qword [rsp + 0x1850]
mov qword [0x140577370], rax
mov rax, qword [rsp + 0x1618]
mov qword [0x140577378], rax
mov rcx, qword [rsp + 0x1850]
call fcn.140035970
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.140033b50
lea r8, str._start_data
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.14003c230
xor r8d, r8d
lea rdx, [0x140196f20]
mov rcx, qword [rsp + 0x1850]
call fcn.140035e50
lea r8, str._start
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x1850]
call fcn.14003c230
mov r9d, 0xe08
xor r8d, r8d
lea rdx, str.global.__msh___MSH__
mov rcx, qword [rsp + 0x1850]
call fcn.14003f390
lea r8, [0x1405710f0]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x1850]
call fcn.14003c820
test eax, eax
je 0x140199bc3
mov rcx, qword [rsp + 0x1850]
call fcn.140036e50
mov r9d, 0xf08
xor r8d, r8d
lea rdx, str.global.ackJSON.parse_global.__msh.ack_
mov rcx, qword [rsp + 0x1850]
call fcn.14003f390
mov r9d, 0xf08
xor r8d, r8d
lea rdx, str.global.bcolorglobal.__msh.background
mov rcx, qword [rsp + 0x1850]
call fcn.14003f390
mov r9d, 0xf08
xor r8d, r8d
lea rdx, str.global.fcolorglobal.__msh.foreground
mov rcx, qword [rsp + 0x1850]
call fcn.14003f390
mov r9d, 0xf08
xor r8d, r8d
lea rdx, str.global.bimageglobal.__msh.image_global.__msh.image:default2_
mov rcx, qword [rsp + 0x1850]
call fcn.14003f390
mov r9, qword [rsp + 0x1618]
mov r8, qword [rsp + 0x1618]
lea rdx, str.global.ackTitle__global.ack.captions__s__global.ack.captions__s_.title:global.ack.captions_en_.title_
mov rcx, qword [rsp + 0x1850]
call fcn.140035330
mov r9d, 0x909
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x1850]
call fcn.14003f390
mov r9, qword [rsp + 0x1618]
mov r8, qword [rsp + 0x1618]
lea rdx, str.global.ackText__global.ack.captions__s__global.ack.captions__s_.caption:global.ack.captions_en_.caption_
mov rcx, qword [rsp + 0x1850]
call fcn.140035330
mov r9d, 0x909
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x1850]
call fcn.14003f390
mov r9, qword [rsp + 0x1618]
mov r8, qword [rsp + 0x1618]
lea rdx, str.global.ackLink___text:_global.ack.captions__s_.linkText__url:_global.ack.captions__s_.linkUrl__if_global.ackLink.textnull__global.ackLink.urlnull_delete_global.ackLink_
mov rcx, qword [rsp + 0x1850]
call fcn.140035330
mov r9d, 0x909
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x1850]
call fcn.14003f390
mov r9d, 0xf08
xor r8d, r8d
lea rdx, str.var_x__require_win_userconsent_.create_global.ackTitle__global.ackText____noCheck:_true__background:_global.bcolor__foreground:_global.fcolor__b64Image:_global.bimage__linkText:_global.ackLink__x.then_function_____global._OK__true_____x.pump.on_exit__function______start______
mov rcx, qword [rsp + 0x1850]
call fcn.14003f390
nop
jmp 0x140199bee
mov rcx, qword [rsp + 0x1850]
call fcn.140036e50
mov r9d, 0xf08
xor r8d, r8d
lea rdx, str.global._OKtrue___start___
mov rcx, qword [rsp + 0x1850]
call fcn.14003f390
nop
mov rcx, qword [rsp + 0x1848]
call fcn.14013f850
nop
jmp 0x140199c3d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x1850]
call fcn.14003ab50
mov rdx, rax
lea rcx, str.Error:__s
call fcn.140015e70
mov rcx, qword [rsp + 0x1850]
call fcn.1400e0900
mov rcx, qword [rsp + 0x1848]
call fcn.14013f850
nop
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov dword [rsp + 0x614], 0
jmp 0x140199c61
mov eax, dword [rsp + 0x614]
inc eax
mov dword [rsp + 0x614], eax
xor edx, edx
mov rax, qword [rsp + 0x620]
mov rax, qword [rax - 0x18]
mov ecx, 8
div rcx
cmp dword [rsp + 0x614], eax
jge 0x140199c9c
movsxd rax, dword [rsp + 0x614]
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx + rax*8]
call fcn.140137da0
nop
jmp 0x140199c51
mov rcx, qword [rsp + 0x620]
call fcn.140137da0
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x14043fcd0]
call fcn.14037c300
mov rax, rdi
mov rcx, qword [rsp + 0x18c0]
xor rcx, rsp
call fcn.14037c650
add rsp, 0x18d8
pop rdi
pop rsi
ret