Function at 0x14000b260
Capabilities:
Create process on windows
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1450]
mov eax, 0x1550
call fcn.1401c1690
sub rsp, rax
mov rax, qword [0x1402b9f00]
xor rax, rsp
mov qword [rbp + 0x1440], rax
mov rdi, qword [0x1402bd648]
lea rcx, [rbp]
xor r13d, r13d
mov r14, r8
mov edx, 0x400
mov esi, r13d
lea r9d, [r13 + 1]
lea r8d, [r13 + 8]
call fcn.14008eba4
mov rbx, rax
cmp qword [rax - 0x10], r13
jbe 0x14000b2d3
lea rcx, [rax + 0x18]
add rcx, qword [rax - 0x18]
jmp 0x14000b2d6
mov rcx, r13
mov qword [rcx], rdi
mov rax, qword [rdi + 0x78]
test rax, rax
je 0x14000b2eb
mov ecx, 2
call rax
jmp 0x14000b2f1
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
cmp dword [rbp + 0x1498], 1
jne 0x14000b30d
mov rcx, qword [r14]
lea rdx, str.__slave
call fcn.1401d5470
test eax, eax
je 0x14000b32a
cmp dword [rbp + 0x1498], 2
jne 0x14000b378
mov rcx, qword [r14 + 8]
lea rdx, str.__slave
call fcn.1401d5470
test eax, eax
jne 0x14000b337
mov rcx, rdi
call fcn.1400079b0
jmp 0x14000bb7c
mov rcx, qword [r14 + 8]
lea rdx, str.__netinfo
call fcn.1401d5470
test eax, eax
jne 0x14000b378
lea rcx, [rsp + 0x50]
call fcn.140010158
test eax, eax
jle 0x14000bb7c
mov rdx, qword [rsp + 0x50]
lea rcx, str._s_r_n
call fcn.140001090
mov rcx, qword [rsp + 0x50]
jmp 0x14000bb77
cmp qword [rdi + 0x38], r13
jne 0x14000b3c8
mov qword [rdi + 0x38], rbx
lea rdx, [rbp + 0x440]
mov r8d, 0x800
mov byte [rbx], r13b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [rbx - 0x18]
lea r8, [rbp + 0x440]
mov qword [rsp + 0x38], r13
or r9d, 0xffffffff
mov qword [rsp + 0x30], r13
xor edx, edx
mov dword [rsp + 0x28], eax
mov ecx, 0xfde9
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rdi + 0x38]
lea rdx, [rdi + 0xa04]
call fcn.140003d64
mov r15d, 1
cmp dword [rbp + 0x1498], r15d
jle 0x14000b498
lea rbx, [r14 + 8]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14000b3fc
mov rax, r13
jmp 0x14000b406
mov edx, 0x1000
call fcn.1401c8c84
mov rcx, qword [rbx]
lea r8, [0x14024fc1c]
movsxd rdx, eax
mov r9d, 1
call fcn.140096880
mov r12d, eax
cmp eax, 2
jle 0x14000b47c
mov rcx, qword [rbx]
lea rdx, [0x14024fe0c]
mov r8d, 2
call fcn.1401c8860
test eax, eax
jne 0x14000b47c
cmp r12d, 0xf
jne 0x14000b47c
mov rcx, qword [rbx]
lea r8d, [rax + 0xd]
add rcx, 2
lea rdx, str.configUsesCWD
call fcn.1401c8860
test eax, eax
jne 0x14000b47c
mov rcx, qword [rbx]
lea r8d, [r12 - 0xe]
add rcx, 0x10
lea rdx, [0x14024f238]
call fcn.1401c8860
test eax, eax
je 0x14000b491
inc r15d
add rbx, 8
cmp r15d, dword [rbp + 0x1498]
jge 0x14000b498
jmp 0x14000b3ef
mov dword [rdi + 0x50], 1
mov rcx, qword [rdi + 0x38]
lea rdx, str..log
xor r8d, r8d
call fcn.14000312c
mov rcx, rax
xor edx, edx
call fcn.140096b78
mov qword [0x1402bd600], rax
call fcn.14008cf88
mov rcx, qword [rdi]
lea rdx, [0x140007ad8]
mov r8, rdi
call fcn.14008efd8
mov rcx, qword [r14]
lea r8, [0x14024e87c]
or rdx, 0xffffffffffffffff
call fcn.1400968f8
test eax, eax
jle 0x14000b549
mov r8, qword [r14]
lea r12, [0x1402c2900]
movsxd rbx, eax
mov r15d, 0x10000
mov r9, rbx
mov edx, r15d
mov rcx, r12
call fcn.1401c4220
cmp rbx, r15
jae 0x14000bba8
mov byte [rbx + r12], r13b
or r9d, 0xffffffff
lea rbx, [0x1402be900]
mov dword [rsp + 0x28], 0x1000
mov r8, r12
mov qword [rsp + 0x20], rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rax, [rbp + 0x1498]
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], r14
cmp qword [rdi + 0x20], r13
jne 0x14000bb26
cmp dword [rbp + 0x1498], 2
jl 0x14000b5ca
mov rcx, qword [r14 + 8]
lea r8, [0x1402506f4]
mov r9d, 3
mov dword [rsp + 0x20], 1
or rdx, 0xffffffffffffffff
call fcn.1400967bc
test eax, eax
jne 0x14000bb26
cmp dword [rbp + 0x1498], 2
jl 0x14000b5ca
mov rcx, qword [r14 + 8]
lea r9d, [rax + 4]
lea r8, str..zip
mov dword [rsp + 0x20], 1
or rdx, 0xffffffffffffffff
call fcn.1400967bc
test eax, eax
jne 0x14000bb26
mov rcx, qword [rdi]
lea r9, [rbp - 0x20]
xor r8d, r8d
lea rdx, [0x14000b224]
call fcn.14008f0c8
mov rcx, qword [rdi]
call fcn.140092010
mov qword [rdi], r13
cmp qword [rdi + 0x48], r13
je 0x14000b8d7
cmp dword [rdi + 0x9d8], r13d
je 0x14000b8ca
cmp dword [rdi + 0xba0], r13d
jne 0x14000b7aa
call fcn.140081e5c
mov rbx, qword [rdi + 0x48]
mov rcx, rax
mov r14, rax
call fcn.14001c87c
mov r8, r14
lea rdx, [0x140087b84]
mov rcx, rbx
call fcn.1400998ec
or edx, 0xffffffff
mov rcx, r14
call fcn.14001b01c
test rax, rax
je 0x14000b78c
or edx, 0xffffffff
mov rcx, r14
call fcn.1400190bc
lea r8, [rsp + 0x50]
or edx, 0xffffffff
mov rcx, r14
call fcn.14001abdc
mov rbx, qword [rsp + 0x50]
mov r12, rax
movabs rax, 0xaaaaaaaaaaaaaaab
lea rcx, [rbx*4 + 4]
mul rcx
mov ecx, 0xfffffffa
lea r15, [rbx + 1]
mov rsi, rdx
shr rsi, 1
sub rcx, rsi
cmp r15, rcx
jae 0x14000b6e8
mov eax, 0xfffffffe
lea rdx, [rsi + 5]
sub rax, rbx
cmp rdx, rax
jae 0x14000b6e8
lea rax, [rbx + 6]
mov ecx, 0xffffffe7
add rax, rsi
cmp rax, rcx
jae 0x14000b6e8
test rdx, rdx
je 0x14000b6cb
lea rax, [rbx + 0x1e]
add rax, rsi
cmp rax, rcx
jae 0x14000b6e8
cmp r13, rdx
lea rcx, [rbx + 0x1e]
sbb rax, rax
and eax, 0x18
add rax, rsi
add rcx, rax
call fcn.1401c9318
mov rcx, rax
jmp 0x14000b6eb
mov rcx, r13
lea eax, [rsi + 5]
xor r9d, r9d
movsxd r8, eax
lea eax, [rbx + 1]
movsxd rdx, eax
call fcn.14008eba4
mov rsi, rax
cmp qword [rax - 0x10], r13
jbe 0x14000b717
lea rdx, [rax + 0x18]
add rdx, qword [rax - 0x18]
mov qword [rsp + 0x50], rdx
jmp 0x14000b71c
mov qword [rsp + 0x50], r13
mov r9, rbx
mov r8, r12
mov rdx, r15
mov rcx, rsi
call section..text
mov rcx, r14
call fcn.140060434
mov rcx, rsi
cmp rbx, 0x7fffffff
jbe 0x14000b75f
call fcn.14008ec8c
mov rsi, r13
cmp dword [rdi + 0x9e4], r13d
je 0x14000b8ca
lea rcx, str._Service_Parameters___ERROR
jmp 0x14000b7a0
lea r8, [rsp + 0x50]
mov edx, ebx
call fcn.140094e9c
cmp dword [rdi + 0x9e4], r13d
je 0x14000b8ca
mov rdx, rsi
lea rcx, str._Service_Parameters____s
call fcn.1400976f0
jmp 0x14000b8ca
cmp dword [rdi + 0x9e4], r13d
je 0x14000b8ca
lea rcx, str._Service_Parameters___NONE
call fcn.1400976f0
jmp 0x14000b8ca
mov rbx, qword [rdi + 0xbb8]
lea rdx, str.Mesh_Agent
mov rcx, rbx
call fcn.1401d5470
test eax, eax
je 0x14000b8ca
mov r8, qword [rbx - 0x18]
movabs rsi, 0xaaaaaaaaaaaaaaab
mov rax, rsi
lea rcx, [r8*4 + 0x78]
mul rcx
mov ecx, 0xfffffffa
lea rax, [r8 + 0x1e]
shr rdx, 1
sub rcx, rdx
cmp rax, rcx
jae 0x14000b849
mov eax, 0xffffffe1
lea r9, [rdx + 5]
sub rax, r8
cmp r9, rax
jae 0x14000b849
lea rax, [r8 + 0x23]
mov ecx, 0xffffffe7
add rax, rdx
cmp rax, rcx
jae 0x14000b849
test r9, r9
je 0x14000b82b
lea rax, [r8 + 0x3b]
add rax, rdx
cmp rax, rcx
jae 0x14000b849
mov ecx, 0x3b
test r9, r9
lea eax, [rcx + 0x18]
cmovne ecx, eax
add rcx, rdx
add rcx, r8
call fcn.1401c9318
mov r10, rax
jmp 0x14000b84c
mov r10, r13
mov r9, qword [rdi + 0xbb8]
mov rax, qword [r9 - 0x18]
lea rcx, [rax*4 + 0x78]
mov rax, rsi
mul rcx
mov eax, dword [r9 - 0x18]
mov rcx, r10
shr rdx, 1
add eax, 0x1e
add rdx, 5
xor r9d, r9d
movsxd r8, edx
movsxd rdx, eax
call fcn.14008eba4
mov rsi, rax
cmp qword [rax - 0x10], r13
jbe 0x14000b89c
lea rcx, [rax + 0x18]
add rcx, qword [rax - 0x18]
mov qword [rsp + 0x50], rcx
jmp 0x14000b8a1
mov qword [rsp + 0x50], r13
mov r9, qword [rdi + 0xbb8]
lea r8, str.____meshServiceName__s___
mov rdx, qword [rax - 0x18]
mov rcx, rsi
call fcn.1400010e4
mov edx, eax
lea r8, [rsp + 0x50]
mov rcx, rsi
call fcn.140094e9c
mov rcx, qword [rdi + 0x48]
call fcn.14009a374
mov qword [rdi + 0x48], r13
cmp dword [rdi + 0x9d8], r13d
je 0x14000bb47
xor edx, edx
mov dword [rsp + 0x70], WSAGetLastError
lea rcx, [rsp + 0x78]
lea r8d, [rdx + 0x60]
call fcn.1401c25f0
mov rcx, qword [rdi + 0x38]
lea rdx, str..update.exe
xor r8d, r8d
call fcn.14000312c
mov r14, rax
cmp dword [rdi + 0x9e4], r13d
je 0x14000b934
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.SelfUpdate____Updating...
xor edx, edx
call fcn.1400975c8
cmp dword [rdi + 0xba8], r13d
jne 0x14000b966
mov rax, qword [rdi + 0x38]
lea rbx, [0x1402c1900]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r9, r14
lea r8, str._s__update:__s_
mov edx, 0x1000
call fcn.1400010e4
jmp 0x14000b9c8
test rsi, rsi
jne 0x14000b974
lea rcx, str.W10
jmp 0x14000b987
cmp qword [rsi - 0x10], r13
jbe 0x14000b984
lea rcx, [rsi + 0x18]
add rcx, qword [rsi - 0x18]
jmp 0x14000b987
mov rcx, r13
cmp dword [rdi + 0xba0], r13d
lea rdx, [0x140250a60]
mov qword [rsp + 0x28], rcx
lea rax, [0x140250a64]
cmovne rax, rdx
lea rbx, [0x1402c1900]
mov edx, 0x1000
mov qword [rsp + 0x20], rax
mov r9, r14
lea r8, str._s__update:_s__s
mov rcx, rbx
call fcn.1400010e4
cmp dword [rdi + 0x9e4], r13d
je 0x14000b9e6
mov edx, dword [rdi + 0xba8]
lea rcx, str.SelfUpdate__d_____CreateProcessW___with_parameters:__s
mov r8, rbx
call fcn.1400976f0
lea r12, [0x1402be900]
mov dword [rsp + 0x28], 0x1000
or r9d, 0xffffffff
mov qword [rsp + 0x20], r12
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x58]
mov r15d, 0x8000000
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rdx, r12
mov qword [rsp + 0x38], r13
xor ecx, ecx
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000bb0e
cmp dword [rdi + 0x9e4], r13d
je 0x14000ba7a
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.SelfUpdate____FAILED...
xor edx, edx
call fcn.1400975c8
test r14, r14
je 0x14000bb47
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x14000bb47
jmp 0x14000baa1
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rdi + 0x38]
mov rdx, r14
call fcn.14008cee4
test eax, eax
je 0x14000ba92
mov dword [rsp + 0x28], 0x1000
or r9d, 0xffffffff
mov r8, rbx
mov qword [rsp + 0x20], r12
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
mov rdx, r12
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000bb47
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000bb47
mov rcx, qword [rdi]
lea r9, [rbp - 0x20]
xor r8d, r8d
lea rdx, [0x14000b210]
call fcn.14008f0c8
mov rcx, qword [rdi]
call fcn.140092010
mov qword [rdi], r13
test rsi, rsi
je 0x14000bb54
mov rcx, rsi
call fcn.14008ec8c
mov eax, dword [0x1402bd5f0]
dec eax
mov dword [0x1402bd5f0], eax
test eax, eax
jg 0x14000bb6b
call fcn.1400cb6f0
mov rcx, qword [0x1402bd600]
test rcx, rcx
je 0x14000bb7c
call fcn.1401c8c7c
xor eax, eax
mov rcx, qword [rbp + 0x1440]
xor rcx, rsp
call fcn.1401c1120
mov rbx, qword [rsp + 0x1590]
add rsp, 0x1550
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1401c124c
int3