Function at 0x140016e78
Capabilities:
Accept command line arguments
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
lea rcx, [rbp - 0x20]
call fcn.14001f0e4
cmp qword [rax + 0x18], 0x10
jb 0x140016ea2
mov rax, qword [rax]
mov rcx, rax
call fcn.14001f590
mov rdx, qword [rbp - 8]
cmp eax, 1
setg dil
cmp rdx, 0x10
jb 0x140016ecd
mov rcx, qword [rbp - 0x20]
inc rdx
mov r8d, 1
call fcn.140004554
xor ebx, ebx
test dil, dil
jne 0x140017163
lea edi, [rbx + 4]
mov ecx, edi
lea rdx, str.ALL_SLOW_SLOW__r_n
call fcn.1400191e0
call fcn.1400238c0
mov ecx, 0x64000
call fcn.1400607d0
mov ecx, 0x4388
mov rsi, rax
call fcn.1400607d0
xor edx, edx
mov qword [0x1400c51e8], rax
mov r8d, 0x4388
mov rcx, rax
call fcn.14003a5c0
mov rcx, qword [0x1400c51e8]
mov byte [rcx + 0x4384], 1
mov rcx, qword [0x1400c51e8]
mov dword [rcx + 0x294], 0x12c
xor ecx, ecx
mov rdx, qword [0x1400c51e8]
call fcn.140017558
test eax, eax
jne 0x140016f60
lea rdx, str.ZCCM:_parse_config_failed__r_n
mov ecx, edi
call fcn.1400191e0
jmp 0x14001713e
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
lea rdx, str.__IsDev
call fcn.14003a760
test rax, rax
lea rcx, str.192.168.145.1:8080
cmove rcx, qword [str.r.ywcywl.com]
mov qword [str.r.ywcywl.com], rcx
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.140009ef0
test eax, eax
jne 0x140016fbf
lea rdx, str.ZCCM:_GetLogFilePath_failed__r_n
mov ecx, edi
call fcn.1400191e0
call fcn.140016d58
test eax, eax
je 0x14001713e
xor eax, eax
mov byte [rbp - 0x20], bl
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x1f], rax
mov qword [rbp - 0x17], rax
mov qword [rbp - 0xf], rax
lea edx, [rax + 0x1f]
mov dword [rbp - 7], eax
mov word [rbp - 3], ax
mov byte [rbp - 1], al
call fcn.140009aac
cmp byte [rbp - 0x20], bl
jne 0x14001700e
mov edx, 0x1f
lea rcx, [rbp - 0x20]
call fcn.140015c60
cmp byte [rbp - 0x20], bl
jne 0x14001700e
lea rdx, str.ZCCM:_GetAgentNameFromLog__Web_failed__r_n
mov ecx, edi
call fcn.1400191e0
jmp 0x14001702b
mov rcx, qword [0x1400c51e8]
lea rdx, [rbp - 0x20]
add rcx, 0x268
mov r8d, 0x1f
call fcn.140045fa0
movups xmm0, xmmword [str.ZCCM:__s__r_n]
mov r8, qword [0x1400c51e8]
lea rdx, [rbp - 0x30]
add r8, 0x268
mov ecx, edi
movdqu xmmword [rbp - 0x30], xmm0
call fcn.1400191e0
call fcn.140011960
mov r8, qword [0x1400c51e8]
mov edx, 0x64000
mov rcx, rsi
lea r9, [r8 + 0x148]
add r8, 0x268
call fcn.140015f64
test eax, eax
jne 0x140017093
lea rdx, str.ZCCM:_GetHttpM_Config_failed__r_n
mov ecx, edi
call fcn.1400191e0
mov ecx, 0x42e576f7
jmp 0x140017138
mov rdx, qword [0x1400c51e8]
mov rcx, rsi
call fcn.140017558
test eax, eax
je 0x140016f4d
mov rsi, qword [0x1400c51e8]
mov qword [rbp - 8], reloc.WSOCK32.dll_ntohs
mov qword [rbp - 0x10], rbx
mov byte [rbp - 0x20], bl
cmp byte [rsi + 0x268], bl
je 0x1400170d7
lea rcx, [rsi + 0x268]
call fcn.140045e50
mov rbx, rax
mov r8, rbx
lea rdx, [rsi + 0x268]
lea rcx, [rbp - 0x20]
call fcn.140004d8c
lea rcx, [rbp - 0x20]
call fcn.14000a620
xor r8d, r8d
lea rcx, [0x140019a44]
xor edx, edx
call fcn.1400604a4
xor r8d, r8d
lea rcx, [0x14001a110]
xor edx, edx
call fcn.1400604a4
call fcn.1400079b0
call fcn.140024954
call fcn.140025efc
call fcn.140005e44
call fcn.140003674
call fcn.140032460
mov ecx, 0x2aea5400
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.ZCCM:_exited__r_n
mov ecx, edi
call fcn.1400191e0
mov rbx, qword [rsp + 0x60]
xor eax, eax
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
lea rdx, str.ZCCM:_process_existed__bye__r_n
mov ecx, 4
call fcn.1400191e0
xor ecx, ecx
call fcn.140060bdc
int3