Function at 0x1400b6c10
Capabilities:
Set registry value
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc40
mov rax, qword [0x1402e8ed8]
xor rax, rsp
mov qword [rsp + 0xc30], rax
mov r14, rdx
movsxd rsi, ecx
mov dword [rsp + 0x60], esi
lea eax, [rsi + 1]
mov dword [rsp + 0x50], eax
lea rdi, [rsi*8 + 8]
mov eax, 0xffffffff
cmp rdi, rax
jae 0x1400b6c80
cmp rax, rdi
je 0x1400b6c80
mov r13d, 0xffffffe7
cmp rdi, r13
jae 0x1400b6c86
lea rcx, [rsi*8 + 0x20]
call fcn.1401d7f54
xor ebx, ebx
jmp 0x1400b6c8a
mov r13d, 0xffffffe7
xor ebx, ebx
mov eax, ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.140098bdc
mov rdi, rax
mov qword [rsp + 0x70], rax
mov r15, rsi
test esi, esi
jle 0x1400b6d61
sub rax, r14
mov rdi, rsi
or r12, 0xffffffffffffffff
mov rsi, rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9d, r12d
mov r8, qword [r14]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rsp + 0x58], eax
movsxd r15, eax
mov eax, 0xffffffff
cmp r15, rax
jae 0x1400b6d02
cmp r15, r13
jae 0x1400b6d02
lea rcx, [r15 + 0x18]
call fcn.1401d7f54
jmp 0x1400b6d05
mov rax, rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, rax
call fcn.140098bdc
mov qword [rsi + r14], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov ecx, dword [rsp + 0x58]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, r12d
mov r8, qword [r14]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add r14, 8
sub rdi, 1
jne 0x1400b6cbb
mov rdi, qword [rsp + 0x70]
movsxd rsi, dword [rsp + 0x60]
mov r15, rsi
jmp 0x1400b6d65
or r12, 0xffffffffffffffff
cmp esi, 1
jle 0x1400b70ff
lea rdx, str._finstall
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
je 0x1400b6dfa
lea rdx, str._funinstall
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
je 0x1400b6dfa
lea rdx, str._fulluninstall
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
je 0x1400b6dfa
lea rdx, str._fullinstall
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
je 0x1400b6dfa
lea rdx, str._install
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
je 0x1400b6dfa
lea rdx, str._uninstall
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
je 0x1400b6dfa
lea rdx, [0x14025d2c8]
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b6e39
mov rax, qword [rdi + 8]
mov qword [rdi + r15*8], rax
mov ecx, 0x1c
call fcn.1401d7f54
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
call fcn.140098bdc
mov qword [rdi + 8], rax
lea r8, [0x14025db10]
mov rdx, qword [rax - 0x18]
mov rcx, rax
call fcn.1400011e0
mov esi, dword [rsp + 0x50]
cmp esi, 1
jle 0x1400b70ff
lea rdx, str._licenses
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b70ff
lea r14, str._n
mov rcx, r14
call fcn.140001128
lea rcx, str.___Licensed_under_the_Apache_License__Version_2.0__the__License____n
call fcn.140001128
lea rcx, str.___you_may_not_use_this_file_except_in_compliance_with_the_License._n
call fcn.140001128
lea rcx, str.___You_may_obtain_a_copy_of_the_License_at_n
call fcn.140001128
lea rsi, [0x1402c6494]
mov rcx, rsi
call fcn.140001128
lea rcx, str.___http:__www.apache.org_licenses_LICENSE_2.0_n
call fcn.140001128
mov rcx, rsi
call fcn.140001128
lea rcx, str.___Unless_required_by_applicable_law_or_agreed_to_in_writing__software_n
call fcn.140001128
lea rcx, str.___distributed_under_the_License_is_distributed_on_an__AS_IS__BASIS__n
call fcn.140001128
lea rcx, str.___WITHOUT_WARRANTIES_OR_CONDITIONS_OF_ANY_KIND__either_express_or_implied._n
call fcn.140001128
lea rcx, str.___See_the_License_for_the_specific_language_governing_permissions_and_n
call fcn.140001128
lea rcx, str.___limitations_under_the_License._n_n
call fcn.140001128
mov rcx, r14
call fcn.140001128
lea rcx, str._Duktape_Javascript_Engine:_Copyright__c__2013_2019_by_Duktape_authors__see_AUTHORS.rst__n
call fcn.140001128
lea rcx, str.________________________https:__github.com_svaarala_duktape__n
call fcn.140001128
lea rcx, str.________________________http:__opensource.org_licenses_MIT__n
call fcn.140001128
lea rcx, str._________________________________________________________________________________________n
call fcn.140001128
lea rcx, str.___Permission_is_hereby_granted__free_of_charge__to_any_person_obtaining_a_copy_n
call fcn.140001128
lea rcx, str.___of_this_software_and_associated_documentation_files_the__Software____to_deal_n
call fcn.140001128
lea rcx, str.___in_the_Software_without_restriction__including_without_limitation_the_rights_n
call fcn.140001128
lea rcx, str.___to_use__copy__modify__merge__publish__distribute__sublicense__and___or_sell_n
call fcn.140001128
lea rcx, str.___copies_of_the_Software__and_to_permit_persons_to_whom_the_Software_is_n
call fcn.140001128
lea rcx, str.___furnished_to_do_so__subject_to_the_following_conditions_:_n
call fcn.140001128
mov rcx, rsi
call fcn.140001128
lea rcx, str.___The_above_copyright_notice_and_this_permission_notice_shall_be_included_in_n
call fcn.140001128
lea rcx, str.___all_copies_or_substantial_portions_of_the_Software._n
call fcn.140001128
mov rcx, rsi
call fcn.140001128
lea rcx, str.___THE_SOFTWARE_IS_PROVIDED__AS_IS___WITHOUT_WARRANTY_OF_ANY_KIND__EXPRESS_OR_n
call fcn.140001128
lea rcx, str.___IMPLIED__INCLUDING_BUT_NOT_LIMITED_TO_THE_WARRANTIES_OF_MERCHANTABILITY__n
call fcn.140001128
lea rcx, str.___FITNESS_FOR_A_PARTICULAR_PURPOSE_AND_NONINFRINGEMENT.IN_NO_EVENT_SHALL_THE_n
call fcn.140001128
lea rcx, str.___AUTHORS_OR_COPYRIGHT_HOLDERS_BE_LIABLE_FOR_ANY_CLAIM__DAMAGES_OR_OTHER_n
call fcn.140001128
lea rcx, str.___LIABILITY__WHETHER_IN_AN_ACTION_OF_CONTRACT__TORT_OR_OTHERWISE__ARISING_FROM__n
call fcn.140001128
lea rcx, str.___OUT_OF_OR_IN_CONNECTION_WITH_THE_SOFTWARE_OR_THE_USE_OR_OTHER_DEALINGS_IN_n
call fcn.140001128
lea rcx, str.___THE_SOFTWARE._n
call fcn.140001128
mov rcx, r14
call fcn.140001128
lea rcx, str.ZLIB_Data_Compression_Library:_Copyright__c__1995_2017_Jean_loup_Gailly_and_Mark_Adler_n
call fcn.140001128
lea rcx, str._______________________________http:__www.zlib.net__n
call fcn.140001128
lea rcx, str._________________________________________________________________________________________n
call fcn.140001128
lea rcx, str.___This_software_is_provided_as_is__without_any_express_or_implied_n
call fcn.140001128
lea rcx, str.___warranty.In_no_event_will_the_authors_be_held_liable_for_any_damages_n
call fcn.140001128
lea rcx, str.___arising_from_the_use_of_this_software._n
call fcn.140001128
lea rcx, [0x14025d0e0]
call fcn.140001128
lea rcx, str.___Permission_is_granted_to_anyone_to_use_this_software_for_any_purpose__n
call fcn.140001128
lea rcx, str.___including_commercial_applications__and_to_alter_it_and_redistribute_it_n
call fcn.140001128
lea rcx, str.___freely__subject_to_the_following_restrictions_:_n
call fcn.140001128
lea rcx, [0x14025d0e0]
call fcn.140001128
lea rcx, str.___1._The_origin_of_this_software_must_not_be_misrepresented__you_must_not_n
call fcn.140001128
lea rcx, str.______claim_that_you_wrote_the_original_software.If_you_use_this_software_n
call fcn.140001128
lea rcx, str.______in_a_product__an_acknowledgment_in_the_product_documentation_would_be_n
call fcn.140001128
lea rcx, str.______appreciated_but_is_not_required._n
call fcn.140001128
lea rcx, str.___2._Altered_source_versions_must_be_plainly_marked_as_such__and_must_not_be_n
call fcn.140001128
lea rcx, str.______misrepresented_as_being_the_original_software._n
call fcn.140001128
lea rcx, str.___3._This_notice_may_not_be_removed_or_altered_from_any_source_distribution._n
call fcn.140001128
mov r14d, ebx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400b85a2
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.140098cbc
inc r14d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp r14d, eax
jl 0x1400b70de
jmp 0x1400b85a2
mov r14, rbx
mov qword [rsp + 0x50], rbx
mov r15d, ebx
mov dword [rsp + 0x58], ebx
mov r13d, ebx
cmp esi, 1
jle 0x1400b7226
lea rdx, str._info
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b7226
lea r8, str.May_24_2022
lea rdx, str.11:29:54
lea rcx, str.Compiled_on:__s___s_n
call fcn.140001128
lea rdx, str.b15afc9816af2b4daf9c239eb9029bbcf6704800
lea rcx, str.___Commit_Hash:__s_n
call fcn.140001128
lea rdx, str.2022_Mar_14_15:51:130100
lea rcx, str.___Commit_Date:__s_n
call fcn.140001128
xor ecx, ecx
call fcn.1400d5500
mov rdx, rax
lea rcx, str.Using__s_n
call fcn.140001128
mov edx, 4
lea rcx, str.Agent_ARCHID:__d_n
call fcn.140001128
movaps xmm0, xmmword [str.console.log_Detected_OS:___require_os_.Name_______require_os_.arch____process.exit___]
movaps xmmword [rsp + 0x600], xmm0
movaps xmm1, xmmword [0x1402c70f0]
movaps xmmword [rsp + 0x610], xmm1
movaps xmm0, xmmword [0x1402c7100]
movaps xmmword [rsp + 0x620], xmm0
movaps xmm1, xmmword [0x1402c7110]
movaps xmmword [rsp + 0x630], xmm1
movaps xmm0, xmmword [0x1402c7120]
movaps xmmword [rsp + 0x640], xmm0
movaps xmm1, xmmword [0x1402c7130]
movaps xmmword [rsp + 0x650], xmm1
mov al, byte [0x1402c7140]
mov byte [rsp + 0x660], al
mov r13d, 0x60
mov edx, r13d
lea rcx, [rsp + 0x600]
call fcn.1400a0f00
mov r14, rax
mov qword [rsp + 0x50], rax
mov r15d, r13d
mov dword [rsp + 0x58], r13d
cmp esi, 2
jle 0x1400b736f
lea rdx, str._faddr
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b72e2
mov qword [rsp + 0x50], rbx
mov rcx, qword [rdi + 0x10]
add rcx, 2
lea r8, [rsp + 0x50]
lea rdx, str._016llx
call fcn.14000db24
mov r8, qword [rsp + 0x50]
call fcn.14009a70c
lea rdx, [0x1402f0ca0]
lea rcx, [0x14025b994]
call fcn.140001128
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400b72ab
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.140098cbc
inc ebx
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400b7291
mov rcx, rdi
call fcn.140098cbc
xor eax, eax
mov rcx, qword [rsp + 0xc30]
xor rcx, rsp
call fcn.1401c9740
lea r11, [rsp + 0xc40]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp esi, 2
jle 0x1400b736f
lea rdx, str._fdelta
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b736f
mov qword [rsp + 0x50], rbx
lea r8, [rsp + 0x50]
lea rdx, str._lld
mov rcx, qword [rdi + 0x10]
call fcn.14000db24
lea r8, [0x1400994a0]
sub r8, qword [rsp + 0x50]
call fcn.14009a70c
lea rdx, [0x1402f0ca0]
lea rcx, [0x14025b994]
call fcn.140001128
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400b72ab
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.140098cbc
inc ebx
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400b7350
jmp 0x1400b72ab
test r14, r14
je 0x1400b7379
test r13d, r13d
jne 0x1400b73e7
mov r8d, 0x104
lea rdx, [rsp + 0x600]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x208
lea rax, [rsp + 0xa20]
mov qword [rsp + 0x20], rax
mov r9d, r12d
lea r8, [rsp + 0x600]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xa20]
call fcn.1400889b4
mov r14, qword [rsp + 0x50]
mov r15d, dword [rsp + 0x58]
cmp esi, 2
jle 0x1400b7484
lea rdx, str._exec
mov rcx, qword [rdi + 8]
call fcn.1401e3480
test eax, eax
jne 0x1400b7436
test r15d, r15d
jne 0x1400b7436
xor edx, edx
mov rcx, qword [rdi + 0x10]
call fcn.1400a0f00
mov r14, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1400b7426
mov r15d, ebx
jmp 0x1400b7436
mov edx, 0x1000
mov rcx, rax
call fcn.1401d7904
mov r15, rax
cmp esi, 2
jle 0x1400b7484
lea rdx, str._b64exec
mov rcx, qword [rdi + 8]
call fcn.1401e3480
test eax, eax
jne 0x1400b7484
test r15d, r15d
jne 0x1400b7484
mov rcx, qword [rdi + 0x10]
test rcx, rcx
jne 0x1400b7462
mov rax, rbx
jmp 0x1400b7470
mov edx, 0x10000
call fcn.1401d7904
mov rcx, qword [rdi + 0x10]
lea r8, [rsp + 0x50]
mov edx, eax
call fcn.14009f350
mov r15d, eax
mov r14, qword [rsp + 0x50]
cmp esi, 1
jle 0x1400b7654
lea rdx, str._nodeid
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b7510
movups xmm0, xmmword [str.console.log_require__agentNodeId_____process.exit___]
movups xmmword [rsp + 0x600], xmm0
movups xmm1, xmmword [0x1402c7198]
movups xmmword [rsp + 0x610], xmm1
movups xmm0, xmmword [0x1402c71a8]
movups xmmword [rsp + 0x620], xmm0
mov eax, dword [0x1402c71b8]
mov dword [rsp + 0x630], eax
movzx eax, word [0x1402c71bc]
mov word [rsp + 0x634], ax
mov al, byte [0x1402c71be]
mov byte [rsp + 0x636], al
mov r15d, gethostname
mov edx, r15d
lea rcx, [rsp + 0x600]
call fcn.1400a0f00
mov r14, rax
cmp esi, 1
jle 0x1400b7654
lea rdx, str._name
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b759e
movaps xmm0, xmmword [str.console.log_require__agentNodeId_.serviceName____process.exit___]
movaps xmmword [rsp + 0x600], xmm0
movaps xmm1, xmmword [0x1402c71e0]
movaps xmmword [rsp + 0x610], xmm1
movaps xmm0, xmmword [0x1402c71f0]
movaps xmmword [rsp + 0x620], xmm0
movaps xmm1, xmmword [0x1402c7200]
movaps xmmword [rsp + 0x630], xmm1
movzx eax, word [0x1402c7210]
mov word [rsp + 0x640], ax
mov al, byte [0x1402c7212]
mov byte [rsp + 0x642], al
mov r15d, 0x42
mov edx, r15d
lea rcx, [rsp + 0x600]
call fcn.1400a0f00
mov r14, rax
cmp esi, 1
jle 0x1400b7654
lea rdx, str.state
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b7654
lea rdx, [rsp + 0x600]
lea rax, [0x140000000]
lea rcx, [rax + 0x2c7220]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
mov r13d, 0x80
add rdx, r13
movups xmm0, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm0
add rcx, r13
movups xmm1, xmmword [rcx]
movups xmmword [rdx], xmm1
movups xmm0, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm0
mov rax, qword [rcx + 0x20]
mov qword [rdx + 0x20], rax
mov eax, dword [rcx + 0x28]
mov dword [rdx + 0x28], eax
lea r15d, [r13 + 0x2b]
mov edx, r15d
lea rcx, [rsp + 0x600]
call fcn.1400a0f00
mov r14, rax
jmp 0x1400b765a
mov r13d, 0x80
cmp esi, 1
jle 0x1400b7890
lea rdx, str.start
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
je 0x1400b768f
lea rdx, str._start
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b7728
lea rcx, [rsp + 0x600]
lea rax, [0x140000000]
lea rax, [rax + 0x2c72e0]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
add rcx, r13
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
add rax, r13
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movzx eax, word [rax + 0x40]
mov word [rcx + 0x40], ax
mov r15d, 0xc1
mov edx, r15d
lea rcx, [rsp + 0x600]
call fcn.1400a0f00
mov r14, rax
cmp esi, 1
jle 0x1400b7890
lea rdx, str.stop
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
je 0x1400b7759
lea rdx, str._stop
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b77d6
lea rax, [rsp + 0x600]
lea rcx, str.tryrequire_service_manager_.manager.getService_require__agentNodeId_.serviceName___.stop__.then_function_m_console.log_Service_Stopped__process.exit_____function_m_console.log_m__process.exit_____catch_z_console.log_Failed_to_stop_service__process.exit___
mov edx, 2
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
add rax, r13
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
add rcx, r13
sub rdx, 1
jne 0x1400b776d
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
mov r15d, 0x10f
mov edx, r15d
lea rcx, [rsp + 0x600]
call fcn.1400a0f00
mov r14, rax
cmp esi, 1
jle 0x1400b7890
lea rdx, str.restart
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
je 0x1400b780b
lea rdx, str._restart
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b7890
lea rcx, [rsp + 0x600]
lea rax, str.tryrequire_service_manager_.manager.getService_require__agentNodeId_.serviceName___.restart__.then_function_m_console.log_Service_Restarted__process.exit_____function_m_console.log_m__process.exit_____catch_z_console.log_Failed_to_restart_service__process.exit___
mov edx, 2
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
add rcx, r13
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
add rax, r13
sub rdx, 1
jne 0x1400b781f
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
mov rax, qword [rax + 0x10]
mov qword [rcx + 0x10], rax
mov r15d, 0x117
mov edx, r15d
lea rcx, [rsp + 0x600]
call fcn.1400a0f00
mov r14, rax
mov r13d, 1
cmp esi, r13d
jle 0x1400b79cd
lea rdx, str._agentHash
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b793a
test r15d, r15d
jne 0x1400b793a
movaps xmm0, xmmword [str.console.log_getSHA384FileHash_process.execPath_.toString_hex_.substring_0_16___process.exit___]
movaps xmmword [rsp + 0x600], xmm0
movaps xmm1, xmmword [0x1402c7630]
movaps xmmword [rsp + 0x610], xmm1
movaps xmm0, xmmword [0x1402c7640]
movaps xmmword [rsp + 0x620], xmm0
movaps xmm1, xmmword [0x1402c7650]
movaps xmmword [rsp + 0x630], xmm1
movaps xmm0, xmmword [0x1402c7660]
movaps xmmword [rsp + 0x640], xmm0
movaps xmm1, xmmword [0x1402c7670]
movaps xmmword [rsp + 0x650], xmm1
mov al, byte [0x1402c7680]
mov byte [rsp + 0x660], al
lea r15d, [r13 + 0x5f]
mov edx, r15d
lea rcx, [rsp + 0x600]
call fcn.1400a0f00
mov r14, rax
cmp esi, r13d
jle 0x1400b79cd
lea rdx, str._agentFullHash
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b79cd
test r15d, r15d
jne 0x1400b79cd
movaps xmm0, xmmword [str.console.log_getSHA384FileHash_process.execPath_.toString_hex___process.exit___]
movaps xmmword [rsp + 0x600], xmm0
movaps xmm1, xmmword [0x1402c76b0]
movaps xmmword [rsp + 0x610], xmm1
movaps xmm0, xmmword [0x1402c76c0]
movaps xmmword [rsp + 0x620], xmm0
movaps xmm1, xmmword [0x1402c76d0]
movaps xmmword [rsp + 0x630], xmm1
movaps xmm0, xmmword [0x1402c76e0]
movaps xmmword [rsp + 0x640], xmm0
mov al, byte [0x1402c76f0]
mov byte [rsp + 0x650], al
mov r15d, 0x50
mov edx, r15d
lea rcx, [rsp + 0x600]
call fcn.1400a0f00
mov r14, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
cmp esi, r13d
jle 0x1400b7cf3
lea rdx, str._updaterversion
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b7a52
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
mov r8d, 2
lea rdx, [0x1402c7708]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400b72ab
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.140098cbc
add ebx, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400b7a32
jmp 0x1400b72ab
cmp esi, r13d
jle 0x1400b7cf3
lea rdx, str._kvm0
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b7b98
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 0x20]
call fcn.140098eb8
mov r15, rax
lea rax, [0x1400b6b94]
mov qword [r15], rax
mov dword [r15 + 0x10], ebx
cmp esi, 2
jle 0x1400b7ab0
lea rdx, str._coredump
mov rcx, qword [rdi + 0x10]
call fcn.1401d6ab0
test eax, eax
mov eax, r13d
je 0x1400b7ab2
mov eax, ebx
mov dword [r15 + 0x18], eax
cmp esi, 2
jle 0x1400b7acf
lea rdx, str._remotecursor
mov rcx, qword [rdi + 0x10]
call fcn.1401d6ab0
test eax, eax
je 0x1400b7ae8
cmp esi, 3
jle 0x1400b7aef
lea rdx, str._remotecursor
mov rcx, qword [rdi + 0x18]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b7aef
mov dword [0x1402ec4c0], r13d
xor edx, edx
mov r8d, 0x800
lea rcx, str.Shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov r14, rbx
test rax, rax
je 0x1400b7b33
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x1400b7b33
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, rbx
test r14, r14
je 0x1400b7b4b
mov ecx, 2
call r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400b7b51
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
mov ecx, r13d
call fcn.14000cdc0
mov rcx, r15
call fcn.14000fb4c
mov r14d, ebx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400b85a2
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.140098cbc
add r14d, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp r14d, eax
jl 0x1400b7b77
jmp 0x1400b85a2
cmp esi, r13d
jle 0x1400b7cf3
lea rdx, str._kvm1
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b7cde
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 0x20]
call fcn.140098eb8
mov r15, rax
lea rax, [0x1400b6b94]
mov qword [r15], rax
mov dword [r15 + 0x10], r13d
cmp esi, 2
jle 0x1400b7bf6
lea rdx, str._coredump
mov rcx, qword [rdi + 0x10]
call fcn.1401d6ab0
test eax, eax
mov eax, r13d
je 0x1400b7bf8
mov eax, ebx
mov dword [r15 + 0x18], eax
cmp esi, 2
jle 0x1400b7c15
lea rdx, str._remotecursor
mov rcx, qword [rdi + 0x10]
call fcn.1401d6ab0
test eax, eax
je 0x1400b7c2e
cmp esi, 3
jle 0x1400b7c35
lea rdx, str._remotecursor
mov rcx, qword [rdi + 0x18]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b7c35
mov dword [0x1402ec4c0], r13d
xor edx, edx
mov r8d, 0x800
lea rcx, str.Shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov r14, rbx
test rax, rax
je 0x1400b7c79
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x1400b7c79
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, rbx
test r14, r14
je 0x1400b7c91
mov ecx, 2
call r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400b7c97
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
mov ecx, r13d
call fcn.14000cdc0
mov rcx, r15
call fcn.14000fb4c
mov r14d, ebx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400b85a2
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.140098cbc
add r14d, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp r14d, eax
jl 0x1400b7cbd
jmp 0x1400b85a2
cmp esi, r13d
jle 0x1400b7cf3
lea rdx, str._kvmtest
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test r14, r14
jne 0x1400b84b1
test esi, esi
jle 0x1400b7d17
lea rdx, str.__slave
mov rcx, qword [rdi]
call fcn.1401d6ab0
test eax, eax
je 0x1400b84b1
cmp esi, r13d
jle 0x1400b7fae
lea rdx, [0x14025db10]
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
je 0x1400b84b1
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
je 0x1400b84b1
lea rdx, str.__slave
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
je 0x1400b84b1
cmp esi, r13d
jle 0x1400b7fae
mov rax, qword [rdi + 8]
movabs rcx, 0x3a6574616470752d
cmp qword [rax], rcx
jne 0x1400b7ebb
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov r15d, 0x400
mov ecx, r15d
call fcn.140098eb8
mov r14, rax
mov rcx, qword [rdi + 8]
cmp byte [rcx + 8], 0x2a
jne 0x1400b7dec
cmp esi, 2
jle 0x1400b7db6
mov rax, qword [rdi + 0x10]
jmp 0x1400b7dbd
lea rax, str.null
lea r8, str.true
lea r9, str.false
cmp byte [rcx + 9], 0x53
cmove r9, r8
mov qword [rsp + 0x20], rax
lea r8, str.require_agent_installer_.update__s___s__
mov rdx, r15
mov rcx, r14
call fcn.1400011e0
jmp 0x1400b7e43
cmp esi, 2
jle 0x1400b7e31
lea rdx, [0x14025db10]
mov rcx, qword [rdi + 0x10]
call fcn.1401e3480
test eax, eax
je 0x1400b7e19
lea rdx, str.connect
mov rcx, qword [rdi + 0x10]
call fcn.1401e3480
test eax, eax
jne 0x1400b7e31
mov r9, qword [rdi + 0x10]
lea r8, str.require_agent_installer_.update_false____s___
mov rdx, r15
mov rcx, r14
call fcn.1400011e0
jmp 0x1400b7e43
lea r8, str.require_agent_installer_.update_true__
mov rdx, r15
mov rcx, r14
call fcn.1400011e0
mov r15d, eax
xor ecx, ecx
call fcn.140008110
mov qword [0x1402ec7e0], rax
mov qword [rax + 0x20], r14
mov dword [rax + 0x28], r15d
mov r8, rdi
mov edx, esi
mov rcx, rax
call fcn.14000c5d0
mov rax, qword [0x1402ec7e0]
mov r14d, dword [rax + 0xbac]
mov dword [rsp + 0x6c], r14d
call fcn.14000ccdc
mov qword [0x1402ec7e0], rbx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400b859f
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.140098cbc
add ebx, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400b7e9b
jmp 0x1400b859f
cmp esi, r13d
jle 0x1400b7fae
lea rdx, str._netinfo
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b7ef9
lea rcx, [rsp + 0x70]
call fcn.140011794
test eax, eax
jle 0x1400b8478
mov rcx, qword [rsp + 0x70]
call fcn.1400b676c
jmp 0x1400b8478
cmp esi, r13d
jle 0x1400b7fae
lea rdx, str._setfirewall
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b7f51
mov r8d, 0x104
lea rdx, [rsp + 0x810]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1400b67c0
test eax, eax
je 0x1400b7f89
lea rcx, [rsp + 0x810]
call fcn.1400b64e8
lea rcx, [rsp + 0x810]
call fcn.1400b605c
jmp 0x1400b7fa2
cmp esi, r13d
jle 0x1400b7fae
lea rdx, str._clearfirewall
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b7fae
mov r8d, 0x104
lea rdx, [rsp + 0x810]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1400b67c0
test eax, eax
jne 0x1400b7f95
lea rcx, str.Must_run_as_administrator
jmp 0x1400b83e3
lea rcx, [rsp + 0x810]
call fcn.1400b64e8
lea rcx, [0x1402c7814]
jmp 0x1400b83e3
mov r15d, 2
cmp esi, r15d
jne 0x1400b8090
lea rdx, str._resetnodeid
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b8090
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, [0x14025d630]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400b804d
mov dword [rsp + 0x64], r13d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 2]
xor r8d, r8d
lea rdx, str.ResetNodeId
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1400b8040
lea rcx, str.NodeID_will_be_reset_next_time_the_Svchost_service_is_started.
call fcn.140001128
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400b8059
lea rcx, str.Error_writing_to_registry__try_running_as_administrator.
call fcn.140001128
mov r14d, ebx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400b85a2
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.140098cbc
add r14d, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp r14d, eax
jl 0x1400b806f
jmp 0x1400b85a2
mov r14d, ebx
lea rax, str.Svchost_background_service
mov qword [rsp + 0x600], rax
lea rax, [0x1400b6a08]
mov qword [rsp + 0x608], rax
mov qword [rsp + 0x610], rbx
mov qword [rsp + 0x618], rbx
mov dword [0x1402eca58], esi
mov qword [0x1402eca50], rdi
lea rcx, [rsp + 0x600]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x1400b8478
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x427
jne 0x1400b8478
cmp esi, r15d
jl 0x1400b82fb
mov dword [rsp + 0x20], r13d
mov r9d, 3
lea r8, [0x14025de14]
mov rdx, r12
mov rcx, qword [rdi + 8]
call fcn.1400a0b24
test eax, eax
jne 0x1400b8140
mov dword [rsp + 0x20], r13d
lea r9d, [rax + 4]
lea r8, str..zip
mov rdx, r12
mov rcx, qword [rdi + 8]
call fcn.1400a0b24
test eax, eax
je 0x1400b8184
mov edx, r13d
lea rcx, [0x1400b6bd8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop
xor ecx, ecx
call fcn.140008110
mov qword [0x1402ec7e0], rax
mov dword [rax + 0xbe4], r13d
mov r8, rdi
mov edx, esi
mov rcx, rax
call fcn.14000c5d0
call fcn.14000ccdc
mov qword [0x1402ec7e0], rbx
jmp 0x1400b8478
cmp esi, r15d
jne 0x1400b82fb
lea rdx, [0x1402c78bc]
mov rcx, qword [rdi + 8]
call fcn.1401e3480
test eax, eax
jne 0x1400b8299
mov r8d, 0x104
lea rdx, [rsp + 0xa20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x104
lea rax, [rsp + 0x600]
mov qword [rsp + 0x20], rax
mov r9d, r12d
lea r8, [rsp + 0xa20]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ecx, ecx
call fcn.140099308
mov rsi, rax
mov rcx, rax
call fcn.14009c12c
call fcn.14008b518
mov rcx, rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x600]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
xor edx, edx
call fcn.14008ba6c
mov r14, rax
mov r9d, 0xe88
lea rdx, str.require_util_language_.current.toUpperCase__.split___.join____
mov rcx, rax
call fcn.14001a968
test eax, eax
jne 0x1400b8278
xor r8d, r8d
mov edx, r12d
mov rcx, r14
call fcn.14001cfbc
mov rdx, rax
lea rcx, str.Current_Language:__s_n
call fcn.140001128
mov rcx, r14
call fcn.140066ff0
mov dword [rsi], r15d
mov rcx, rsi
call fcn.14009953c
mov rcx, rsi
call fcn.14009c1e0
mov esi, r13d
mov r14d, r13d
cmp esi, r15d
jne 0x1400b82fb
mov rcx, qword [rdi + 8]
mov rax, r12
inc rax
cmp byte [rcx + rax], bl
jne 0x1400b82a5
mov r8d, 6
cmp rax, r8
jbe 0x1400b82fb
lea rdx, str._lang
call fcn.1401d5a40
test eax, eax
jne 0x1400b82fb
mov rcx, qword [rdi + 8]
inc r12
cmp byte [rcx + r12], bl
jne 0x1400b82cc
mov rdx, r12
mov r9, r13
lea r8, [0x14025d0e4]
call fcn.1400a0bec
movsxd rcx, eax
inc rcx
add rcx, qword [rdi + 8]
mov qword [0x1402ec7f8], rcx
mov esi, r13d
cmp esi, r13d
je 0x1400b83ed
lea rcx, str.Svchost_available_switches:_r_n
call fcn.140001128
lea rcx, str.__run_______________Start_as_a_console_agent._r_n
call fcn.140001128
lea rcx, str.__connect___________Start_as_a_temporary_console_agent._r_n
call fcn.140001128
lea rcx, str.__start_____________Start_the_service._r_n
call fcn.140001128
lea rcx, str.__restart___________Restart_the_service._r_n
call fcn.140001128
lea rcx, str.__stop______________Stop_the_service._r_n
call fcn.140001128
lea rcx, str.__state_____________Display_the_running_state_of_the_service._r_n
call fcn.140001128
lea rcx, str.___signcheck________Perform_self___check._r_n
call fcn.140001128
lea rcx, str.___install__________Install_the_service_from_this_location._r_n
call fcn.140001128
lea rcx, str.___uninstall________Remove_the_service_from_this_location._r_n
call fcn.140001128
lea rcx, str.___nodeid_t_t_tReturn_the_current_agent_identifier._r_n
call fcn.140001128
lea rcx, str.___resetnodeid______Reset_the_NodeID_next_time_the_service_is_started._r_n
call fcn.140001128
lea rcx, str.___fulluninstall____Stop_agent_and_clean_up_the_program_files_location._r_n
call fcn.140001128
lea rcx, str.___fullinstall______Copy_agent_into_program_files__install_and_launch._r_n
call fcn.140001128
lea rcx, [0x14026af5c]
call fcn.140001128
lea rcx, str.____________________The_following_switches_can_be_specified_after__fullinstall:_r_n
call fcn.140001128
lea rcx, [0x14026af5c]
call fcn.140001128
lea rcx, str._______WebProxy_http:__proxyhost:port_______Specify_an_HTTPS_proxy._r_n
call fcn.140001128
lea rcx, str._______agentName_alternate_name_____________Specify_an_alternate_name_to_be_provided_by_the_agent._r_n
call fcn.140001128
jmp 0x1400b8478
test r14d, r14d
jne 0x1400b8478
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor edx, edx
mov r8d, 0x800
lea rcx, str.Shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov r14, rbx
test rax, rax
je 0x1400b8440
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x1400b8440
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, rbx
test r14, r14
je 0x1400b8456
mov ecx, r15d
call r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400b845c
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
mov qword [rsp + 0x20], rbx
lea r9, [0x1400b9710]
xor r8d, r8d
mov edx, 0x88
xor ecx, ecx
call qword [sym.imp.USER32.dll_DialogBoxParamW]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400b72ab
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.140098cbc
add ebx, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400b8491
jmp 0x1400b72ab
mov edx, r13d
lea rcx, [0x1400b6bd8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop
mov r12d, ebx
mov dword [rsp + 0x68], ebx
cmp esi, r13d
jle 0x1400b84ee
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
mov ecx, 0x20
test eax, eax
cmove r12d, ecx
mov dword [rsp + 0x68], r12d
mov ecx, r12d
call fcn.140008110
mov qword [0x1402ec7e0], rax
mov qword [rax + 0x20], r14
mov dword [rax + 0x28], r15d
test r14, r14
jne 0x1400b8537
cmp esi, r13d
jle 0x1400b8545
lea rdx, [0x14025db10]
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
je 0x1400b8537
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.1401d6ab0
test eax, eax
jne 0x1400b8545
mov rax, qword [0x1402ec7e0]
mov dword [rax + 0xbe4], r13d
mov r8, rdi
mov edx, esi
mov rcx, qword [0x1402ec7e0]
call fcn.14000c5d0
mov rax, qword [0x1402ec7e0]
mov r14d, dword [rax + 0xbac]
mov dword [rsp + 0x6c], r14d
call fcn.14000ccdc
mov qword [0x1402ec7e0], rbx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400b859f
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.140098cbc
add ebx, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400b8584
mov ebx, r14d
mov rcx, rdi
call fcn.140098cbc
mov eax, ebx
jmp 0x1400b72b5