Function at 0x14000da20
Capabilities:
Delete registry key
Set environment variable
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x4c0
lea rbp, [rsp + 0x50]
mov rax, qword [0x140325ed8]
xor rax, rbp
mov qword [rbp + 0x460], rax
mov dword [rbp + 0x60], 0
lea rdx, str.__DUMMY__
lea rcx, [0x14032d3dc]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov dword [rbp], 0
jmp 0x14000da7f
mov eax, dword [rbp]
inc eax
mov dword [rbp], eax
mov eax, dword [rbp + 0x498]
cmp dword [rbp], eax
jge 0x14000db4b
movsxd rax, dword [rbp]
mov rcx, qword [rbp + 0x4a0]
mov rax, qword [rcx + rax*8]
lea rcx, str._recovery
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x14000daba
inc rax
test dl, dl
jne 0x14000daa7
xor eax, eax
jmp 0x14000dabf
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14000daea
mov rax, qword [rbp + 0x490]
mov eax, dword [rax + 0x298]
or eax, 0x40
mov rcx, qword [rbp + 0x490]
mov dword [rcx + 0x298], eax
mov dword [rbp + 0x4a8], 0
movsxd rax, dword [rbp]
mov rcx, qword [rbp + 0x4a0]
mov rax, qword [rcx + rax*8]
lea rcx, str._nocertstore
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x14000db16
inc rax
test dl, dl
jne 0x14000db03
xor eax, eax
jmp 0x14000db1b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14000db46
mov dword [rbp + 0x4a8], 0
lea rcx, str._Not_using_Certificate_Store__n
call fcn.1400012d0
mov rax, qword [rbp + 0x490]
mov dword [rax + 0xc70], 1
jmp 0x14000da77
mov dword [rbp], 0
jmp 0x14000db5c
mov eax, dword [rbp]
inc eax
mov dword [rbp], eax
mov eax, dword [rbp + 0x498]
cmp dword [rbp], eax
jge 0x14000dcd3
movsxd rax, dword [rbp]
lea rcx, [0x14032e3c0]
mov rdx, qword [rbp + 0x4a0]
mov rax, qword [rdx + rax*8]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x14000db97
inc rcx
test dl, dl
jne 0x14000db84
xor eax, eax
jmp 0x14000db9c
sbb eax, eax
or eax, 1
test eax, eax
je 0x14000dcb5
movsxd rax, dword [rbp]
lea rcx, [0x14032e3b0]
mov rdx, qword [rbp + 0x4a0]
mov rax, qword [rdx + rax*8]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x14000dbd0
inc rcx
test dl, dl
jne 0x14000dbbd
xor eax, eax
jmp 0x14000dbd5
sbb eax, eax
or eax, 1
test eax, eax
je 0x14000dcb5
movsxd rax, dword [rbp]
lea rcx, [0x14032e3a0]
mov rdx, qword [rbp + 0x4a0]
mov rax, qword [rdx + rax*8]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x14000dc09
inc rcx
test dl, dl
jne 0x14000dbf6
xor eax, eax
jmp 0x14000dc0e
sbb eax, eax
or eax, 1
test eax, eax
je 0x14000dcb5
movsxd rax, dword [rbp]
lea rcx, [0x14032e390]
mov rdx, qword [rbp + 0x4a0]
mov rax, qword [rdx + rax*8]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x14000dc42
inc rcx
test dl, dl
jne 0x14000dc2f
xor eax, eax
jmp 0x14000dc47
sbb eax, eax
or eax, 1
test eax, eax
je 0x14000dcb5
movsxd rax, dword [rbp]
lea rcx, [0x14032e370]
mov rdx, qword [rbp + 0x4a0]
mov rax, qword [rdx + rax*8]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x14000dc77
inc rcx
test dl, dl
jne 0x14000dc64
xor eax, eax
jmp 0x14000dc7c
sbb eax, eax
or eax, 1
test eax, eax
je 0x14000dcb5
movsxd rax, dword [rbp]
lea rcx, [0x14032e360]
mov rdx, qword [rbp + 0x4a0]
mov rax, qword [rdx + rax*8]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x14000dcac
inc rcx
test dl, dl
jne 0x14000dc99
xor eax, eax
jmp 0x14000dcb1
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14000dcce
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14012cb00
mov rcx, qword [rbp + 0x490]
mov qword [rcx + 0x48], rax
jmp 0x14000dcd3
jmp 0x14000db54
mov rax, qword [rbp + 0x490]
cmp qword [rax + 0x48], 0
jne 0x14000dd13
xor r8d, r8d
lea rdx, [0x14032d334]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x38]
call fcn.140004e00
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.14012cb00
mov rcx, qword [rbp + 0x490]
mov qword [rcx + 0x48], rax
mov dword [rbp + 0x58], 0
mov dword [rbp + 0x40], 0
mov dword [rbp + 0xb0], 0
mov dword [rbp + 0xd0], 0
mov dword [rbp], 0
jmp 0x14000dd46
mov eax, dword [rbp]
inc eax
mov dword [rbp], eax
mov eax, dword [rbp + 0x498]
cmp dword [rbp], eax
jge 0x14000e137
movsxd rax, dword [rbp]
mov edx, 0x1000
mov rcx, qword [rbp + 0x4a0]
mov rcx, qword [rcx + rax*8]
call fcn.140001160
mov dword [rbp + 0xb8], eax
movsxd rax, dword [rbp]
lea rcx, [0x14032d7bc]
mov rdx, qword [rbp + 0x4a0]
mov rax, qword [rdx + rax*8]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x14000dda0
inc rcx
test dl, dl
jne 0x14000dd8d
xor eax, eax
jmp 0x14000dda5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14000ddb3
mov dword [rbp + 0xb0], 1
movsxd rax, dword [rbp]
lea rcx, [0x14032e348]
mov rdx, qword [rbp + 0x4a0]
mov rax, qword [rdx + rax*8]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x14000dddf
inc rcx
test dl, dl
jne 0x14000ddcc
xor eax, eax
jmp 0x14000dde4
sbb eax, eax
or eax, 1
test eax, eax
je 0x14000de1d
movsxd rax, dword [rbp]
lea rcx, [0x14032e338]
mov rdx, qword [rbp + 0x4a0]
mov rax, qword [rdx + rax*8]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x14000de14
inc rcx
test dl, dl
jne 0x14000de01
xor eax, eax
jmp 0x14000de19
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14000de24
mov dword [rbp + 0x40], 1
movsxd rax, dword [rbp]
lea rcx, [0x14032e318]
mov rdx, qword [rbp + 0x4a0]
mov rax, qword [rdx + rax*8]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x14000de50
inc rcx
test dl, dl
jne 0x14000de3d
xor eax, eax
jmp 0x14000de55
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14000de96
mov dword [rbp + 0x40], 5
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
lea r9, [0x14032d304]
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str._localService
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012b4d0
movsxd rax, dword [rbp]
lea rcx, [0x14032e2f8]
mov rdx, qword [rbp + 0x4a0]
mov rax, qword [rdx + rax*8]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x14000dec2
inc rcx
test dl, dl
jne 0x14000deaf
xor eax, eax
jmp 0x14000dec7
sbb eax, eax
or eax, 1
test eax, eax
je 0x14000df00
movsxd rax, dword [rbp]
lea rcx, [0x14032e2e8]
mov rdx, qword [rbp + 0x4a0]
mov rax, qword [rdx + rax*8]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x14000def7
inc rcx
test dl, dl
jne 0x14000dee4
xor eax, eax
jmp 0x14000defc
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14000df3d
mov dword [rbp + 0x40], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
lea r9, [0x14032d2bc]
mov r8d, listen
lea rdx, str._deleteData
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012b4d0
movsxd rax, dword [rbp]
lea rcx, [0x14032e2c8]
mov rdx, qword [rbp + 0x4a0]
mov rax, qword [rdx + rax*8]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x14000df69
inc rcx
test dl, dl
jne 0x14000df56
xor eax, eax
jmp 0x14000df6e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14000df79
mov dword [rbp + 0x40], 2
movsxd rax, dword [rbp + 0xb8]
movsxd rcx, dword [rbp]
mov r9d, 1
lea r8, [0x14032d274]
mov rdx, rax
mov rax, qword [rbp + 0x4a0]
mov rcx, qword [rax + rcx*8]
call fcn.1401237f0
mov dword [rbp + 0x4c], eax
cmp dword [rbp + 0x4c], 2
jle 0x14000e132
movsxd rax, dword [rbp]
mov r8d, 2
lea rdx, [0x14032d24c]
mov rcx, qword [rbp + 0x4a0]
mov rcx, qword [rcx + rax*8]
call fcn.140279b30
test eax, eax
jne 0x14000e132
mov eax, dword [rbp + 0x4c]
sub eax, 2
cmp eax, 8
jne 0x14000e08b
movsxd rax, dword [rbp]
mov rcx, qword [rbp + 0x4a0]
mov rax, qword [rcx + rax*8]
add rax, 2
mov r8d, 8
lea rdx, str.readonly
mov rcx, rax
call fcn.140279b30
test eax, eax
jne 0x14000e08b
movsxd rax, dword [rbp]
movsxd rcx, dword [rbp + 0x4c]
mov rdx, qword [rbp + 0x4a0]
mov rax, qword [rdx + rax*8]
lea rax, [rax + rcx + 1]
mov r8d, 1
lea rdx, [0x14032d224]
mov rcx, rax
call fcn.140279b30
test eax, eax
jne 0x14000e08b
mov dword [rbp + 0xd0], 1
mov rax, qword [rbp + 0x490]
cmp qword [rax + 0x48], 0
je 0x14000e08b
xor r8d, r8d
lea rdx, [0x14032d1d4]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x38]
call fcn.140004e00
mov rdx, rax
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012cbe0
mov rax, qword [rbp + 0x490]
cmp qword [rax + 0x48], 0
jne 0x14000e0b0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14012cb00
mov rcx, qword [rbp + 0x490]
mov qword [rcx + 0x48], rax
mov eax, dword [rbp + 0x4c]
inc eax
mov ecx, dword [rbp + 0xb8]
sub ecx, eax
mov eax, ecx
cdqe
movsxd rcx, dword [rbp]
movsxd rdx, dword [rbp + 0x4c]
mov r8, qword [rbp + 0x4a0]
mov rcx, qword [r8 + rcx*8]
lea rcx, [rcx + rdx + 1]
mov edx, dword [rbp + 0x4c]
sub edx, 2
movsxd rdx, edx
movsxd r8, dword [rbp]
mov r9, qword [rbp + 0x4a0]
mov r8, qword [r9 + r8*8]
add r8, 2
mov qword [rbp + 0x1b8], r8
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov r9, rcx
mov r8, rdx
mov rax, qword [rbp + 0x1b8]
mov rdx, rax
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012b4d0
mov eax, dword [rbp + 0x58]
inc eax
mov dword [rbp + 0x58], eax
jmp 0x14000dd3e
mov eax, dword [rbp + 0x58]
mov ecx, dword [rbp + 0x498]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0x498], eax
mov rax, qword [rbp + 0x490]
cmp qword [rax + 0x48], 0
jne 0x14000e16f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14012cb00
mov rcx, qword [rbp + 0x490]
mov qword [rcx + 0x48], rax
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012e9f0
test eax, eax
je 0x14000e1c2
mov edx, 0x400
lea rcx, str.readmsh
call fcn.140001160
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14032e298]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
test eax, eax
je 0x14000e285
xor r8d, r8d
lea rdx, str..mshx
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x38]
call fcn.140004e00
mov rdx, rax
mov rcx, qword [rbp + 0x490]
call fcn.14000cd30
test eax, eax
jne 0x14000e285
xor r8d, r8d
lea rdx, [0x14032e290]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x38]
call fcn.140004e00
mov rdx, rax
mov rcx, qword [rbp + 0x490]
call fcn.14000cd30
test eax, eax
jne 0x14000e285
lea rdx, str.mesh_linumshx
mov rcx, qword [rbp + 0x490]
call fcn.14000cd30
test eax, eax
jne 0x14000e285
lea rdx, str.mesh_limshx
mov rcx, qword [rbp + 0x490]
call fcn.14000cd30
test eax, eax
jne 0x14000e285
xor edx, edx
mov rcx, qword [rbp + 0x490]
call fcn.14000ca30
xor r8d, r8d
lea rdx, [0x14032e254]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x38]
call fcn.140004e00
mov rdx, rax
mov rcx, qword [rbp + 0x490]
call fcn.14000cd30
mov edx, 0x400
lea rcx, [0x14032e248]
call fcn.140001160
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14032e238]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
test eax, eax
je 0x14000e355
mov edx, 0x400
lea rcx, [0x14032e228]
call fcn.140001160
mov qword [rsp + 0x20], 0x1000
lea r9, [0x1403bdcc0]
mov r8, rax
lea rdx, [0x14032e218]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov dword [rbp + 0xb4], eax
movsxd rax, dword [rbp + 0xb4]
cmp rax, 0x1000
jae 0x14000e355
mov qword [rbp + 0x138], 0
movsxd rax, dword [rbp + 0xb4]
mov r9, 0xffffffffffffffff
mov r8, rax
lea rdx, [0x1403bdcc0]
lea rcx, [rbp + 0x138]
call fcn.140113bf0
test eax, eax
jne 0x14000e355
mov rax, qword [rbp + 0x138]
mov qword [0x1403271a8], rax
mov rax, qword [rbp + 0x490]
cmp dword [rax + 0xc70], 0
jne 0x14000e3a9
mov edx, 0x400
lea rcx, str.nocertstore
call fcn.140001160
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14032e1f8]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov rcx, qword [rbp + 0x490]
mov dword [rcx + 0xc70], eax
cmp dword [rbp + 0xb0], 0
je 0x14000e44a
call fcn.1400fcc30
mov rcx, qword [rbp + 0x490]
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
lea rcx, [0x14000d860]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov rcx, qword [rbp + 0x490]
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x490]
mov r9, qword [rcx]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400fd9f0
mov qword [rbp + 0x1c0], rax
mov r9d, 0xe08
xor r8d, r8d
lea rdx, str.require__agentStatus_.start___
mov rcx, qword [rbp + 0x1c0]
call fcn.1400308b0
mov eax, 1
jmp 0x140010f7a
cmp dword [rbp + 0x40], 0
je 0x14000e701
call fcn.1400fcc30
mov rcx, qword [rbp + 0x490]
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
lea rcx, [0x14000d860]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov rcx, qword [rbp + 0x490]
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x490]
mov r9, qword [rcx]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400fd9f0
mov qword [rbp + 0x20], rax
mov r8, qword [rbp + 0x490]
mov rax, qword [rbp + 0x490]
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x20]
call fcn.140004d90
mov r9d, 0xe08
xor r8d, r8d
lea rdx, str.require_user_sessions_.isRoot___
mov rcx, qword [rbp + 0x20]
call fcn.1400308b0
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x20]
call fcn.140035660
test eax, eax
jne 0x14000e519
lea rcx, str.___Administrator_permissions_needed..._n
call fcn.1400012d0
mov dword [rbp + 0x40], 0
xor ecx, ecx
call fcn.1402742dc
mov eax, dword [rbp + 0x40]
mov dword [rbp + 0x5c], eax
cmp dword [rbp + 0x5c], 1
je 0x14000e53a
cmp dword [rbp + 0x5c], 2
je 0x14000e619
cmp dword [rbp + 0x5c], 5
je 0x14000e53a
jmp 0x14000e6f3
mov r9d, 0xe08
xor r8d, r8d
lea rdx, str.require_agent_installer__
mov rcx, qword [rbp + 0x20]
call fcn.1400308b0
lea r8, str.fullInstall
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x20]
call fcn.140031be0
mov edx, 0xfffffffe
mov rcx, qword [rbp + 0x20]
call fcn.140034750
mov rax, qword [rbp + 0x490]
mov rdx, qword [rax + 0x48]
mov rcx, qword [rbp + 0x20]
call fcn.1401060f0
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x20]
call fcn.1400307b0
mov edx, 1
mov rcx, qword [rbp + 0x20]
call fcn.14002f170
test eax, eax
je 0x14000e601
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x20]
call fcn.140037fd0
lea rcx, [0x14032e100]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x14000e5d8
inc rax
test dl, dl
jne 0x14000e5c5
xor eax, eax
jmp 0x14000e5dd
sbb eax, eax
or eax, 1
test eax, eax
je 0x14000e601
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x20]
call fcn.140037fd0
mov rdx, rax
lea rcx, [0x14032d14c]
call fcn.1400012d0
mov rcx, qword [rbp + 0x20]
call fcn.14003d530
mov eax, 1
jmp 0x140010f7a
mov r9d, 0xe08
xor r8d, r8d
lea rdx, [0x14032e0e0]
mov rcx, qword [rbp + 0x20]
call fcn.1400308b0
lea r8, str.fullUninstall
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x20]
call fcn.140031be0
mov edx, 0xfffffffe
mov rcx, qword [rbp + 0x20]
call fcn.140034750
mov rax, qword [rbp + 0x490]
mov rdx, qword [rax + 0x48]
mov rcx, qword [rbp + 0x20]
call fcn.1401060f0
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x20]
call fcn.1400307b0
mov edx, 1
mov rcx, qword [rbp + 0x20]
call fcn.14002f170
test eax, eax
je 0x14000e6e0
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x20]
call fcn.140037fd0
lea rcx, [0x14032e090]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x14000e6b7
inc rax
test dl, dl
jne 0x14000e6a4
xor eax, eax
jmp 0x14000e6bc
sbb eax, eax
or eax, 1
test eax, eax
je 0x14000e6e0
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x20]
call fcn.140037fd0
mov rdx, rax
lea rcx, [0x14032d13c]
call fcn.1400012d0
mov rcx, qword [rbp + 0x20]
call fcn.14003d530
mov eax, 1
jmp 0x140010f7a
mov rcx, qword [rbp + 0x20]
call fcn.1400c98a0
jmp 0x14000e8b9
mov rax, qword [rbp + 0x490]
cmp qword [rax + 0x48], 0
je 0x14000e734
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012e9f0
test eax, eax
je 0x14000e8b9
cmp dword [rbp + 0xd0], 0
jne 0x14000e8b9
mov ecx, gethostname
call fcn.14027bb94
xor r9d, r9d
xor r8d, r8d
mov edx, 0x20
mov rcx, rax
call fcn.140113960
mov qword [rbp + 0x98], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x98]
mov rdx, qword [rbp + 0x490]
mov qword [rcx + rax], rdx
movsxd rax, dword [rbp + 0x498]
mov ecx, 8
imul rcx, rcx, 1
mov rdx, qword [rbp + 0x98]
mov qword [rdx + rcx], rax
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rbp + 0x98]
mov rdx, qword [rbp + 0x4a0]
mov qword [rcx + rax], rdx
movsxd rax, dword [rbp + 0x4a8]
mov ecx, 8
imul rcx, rcx, 3
mov rdx, qword [rbp + 0x98]
mov qword [rdx + rcx], rax
mov rax, qword [rbp + 0x490]
cmp qword [rax + 0x48], 0
je 0x14000e7f1
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012ccb0
mov rax, qword [rbp + 0x490]
mov qword [rax + 0x48], 0
mov rax, qword [rbp + 0x490]
mov eax, dword [rax + 0xdb8]
mov dword [rbp + 0x120], eax
cmp dword [rbp + 0x120], 0xa
je 0x14000e80f
jmp 0x14000e822
lea rcx, str.Unable_to_open_database._r_n
call fcn.1400012d0
xor eax, eax
jmp 0x140010f7a
mov rax, qword [rbp + 0x490]
mov eax, dword [rax + 0xdb8]
inc eax
mov edx, eax
lea rcx, str.Unable_to_open_database___d_10_..._r_n
call fcn.1400012d0
mov rax, qword [rbp + 0x490]
mov eax, dword [rax + 0xdb8]
inc eax
mov rcx, qword [rbp + 0x490]
mov dword [rcx + 0xdb8], eax
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax]
call fcn.140114fe0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x1373
lea rcx, [0x14032dff8]
mov qword [rsp + 0x28], rcx
lea rcx, [0x14000a370]
mov qword [rsp + 0x20], rcx
lea r9, [0x14000d5b0]
mov r8d, 0x7d0
mov rdx, qword [rbp + 0x98]
mov rcx, rax
call fcn.140120670
mov eax, 1
jmp 0x140010f7a
mov rax, qword [rbp + 0x490]
mov rdx, qword [rax]
mov ecx, 3
call fcn.140133a30
mov rcx, qword [rbp + 0x490]
mov qword [rcx + 0x40], rax
mov rax, qword [rbp + 0x490]
cmp qword [rax + 0x48], 0
je 0x14000ea2b
mov r8, qword [rbp + 0x490]
lea rdx, [0x14000d8c0]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012e6b0
mov edx, 0x400
lea rcx, str.enableILibRemoteLogging
call fcn.140001160
mov qword [rsp + 0x20], 0x1000
lea r9, [0x1403bdcc0]
mov r8, rax
lea rdx, [0x14032dfc8]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov dword [rbp + 0xbc], eax
cmp dword [rbp + 0xbc], 0
je 0x14000e9d8
movsxd rax, dword [rbp + 0xbc]
mov qword [rbp + 0x140], rax
cmp qword [rbp + 0x140], 0x1000
jae 0x14000e973
jmp 0x14000e978
call fcn.14026da68
lea rax, [0x1403bdcc0]
mov rcx, qword [rbp + 0x140]
mov byte [rax + rcx], 0
xor r8d, r8d
lea rdx, [0x14032dfc0]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x38]
call fcn.140004e00
mov qword [rbp + 0x1c8], rax
mov edx, 0x1000
lea rcx, [0x1403bdcc0]
call fcn.140113d90
mov rcx, qword [rbp + 0x1c8]
mov r8, rcx
movzx edx, ax
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax]
call fcn.1401146f0
mov edx, 0x400
lea rcx, str.semaphoreTrack
call fcn.140001160
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14032dfa0]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
test eax, eax
je 0x14000ea2b
mov dword [0x1403b8acc], 0
lea rax, [0x14000d990]
mov qword [0x1403b96b0], rax
mov rax, qword [rbp + 0x490]
cmp qword [rax], 0
je 0x14000ea61
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rbp + 0x490]
add rax, qword [rcx]
mov ecx, 8
imul rcx, rcx, 0
mov rax, qword [rax + rcx]
mov qword [rbp + 0x148], rax
jmp 0x14000ea6c
mov qword [rbp + 0x148], 0
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x4a0]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x20], rax
lea r9, str.agentcore:_argv_0____s
mov r8d, 2
mov edx, 0x100
mov rcx, qword [rbp + 0x148]
call fcn.140129b00
call fcn.1400fcc30
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov rcx, qword [rbp + 0x490]
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x490]
mov r9, qword [rcx]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400fd9f0
mov qword [rbp + 0x28], rax
mov r9d, 0xf88
xor r8d, r8d
lea rdx, str.require_linux_pathfix____
mov rcx, qword [rbp + 0x28]
call fcn.1400308b0
mov rax, qword [rbp + 0x490]
mov dword [rax + 0xdbc], 0
mov rax, qword [rbp + 0x490]
mov dword [rax + 0xdc0], 0
mov rax, qword [rbp + 0x490]
mov dword [rax + 0xdc4], 0
mov edx, 0x400
lea rcx, str.meshServiceName
call fcn.140001160
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14032df60]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov dword [rbp + 8], eax
cmp dword [rbp + 8], 0
je 0x14000ec73
mov eax, dword [rbp + 8]
inc eax
cdqe
mov ecx, 0xffffffff
cmp rax, rcx
jae 0x14000ebec
mov eax, dword [rbp + 8]
inc eax
cdqe
mov ecx, 0xffffffff
sub rcx, rax
mov rax, rcx
test rax, rax
jbe 0x14000ebec
mov eax, dword [rbp + 8]
inc eax
cdqe
mov ecx, 0xffffffe7
cmp rax, rcx
jae 0x14000ebec
xor eax, eax
cmp eax, 1
je 0x14000ebec
mov eax, dword [rbp + 8]
inc eax
cdqe
add rax, 0x18
mov rcx, rax
call fcn.14027bb94
mov qword [rbp + 0x150], rax
jmp 0x14000ebf7
mov qword [rbp + 0x150], 0
mov eax, dword [rbp + 8]
inc eax
cdqe
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x150]
call fcn.140113960
mov rcx, qword [rbp + 0x490]
mov qword [rcx + 0xdd8], rax
movsxd rax, dword [rbp + 8]
mov qword [rbp + 0x1d0], rax
mov edx, 0x400
lea rcx, [0x14032df50]
call fcn.140001160
mov rcx, qword [rbp + 0x1d0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x490]
mov r9, qword [rcx + 0xdd8]
mov r8, rax
lea rdx, [0x14032df40]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
jmp 0x14000ec88
mov rax, qword [rbp + 0x490]
lea rcx, [0x14032df30]
mov qword [rax + 0xdd8], rcx
mov edx, 0x400
lea rcx, [0x14032df20]
call fcn.140001160
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14032df10]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov dword [rbp + 8], eax
cmp dword [rbp + 8], 0
je 0x14000edaf
mov eax, dword [rbp + 8]
inc eax
cdqe
mov ecx, 0xffffffff
cmp rax, rcx
jae 0x14000ed28
mov eax, dword [rbp + 8]
inc eax
cdqe
mov ecx, 0xffffffff
sub rcx, rax
mov rax, rcx
test rax, rax
jbe 0x14000ed28
mov eax, dword [rbp + 8]
inc eax
cdqe
mov ecx, 0xffffffe7
cmp rax, rcx
jae 0x14000ed28
xor eax, eax
cmp eax, 1
je 0x14000ed28
mov eax, dword [rbp + 8]
inc eax
cdqe
add rax, 0x18
mov rcx, rax
call fcn.14027bb94
mov qword [rbp + 0x158], rax
jmp 0x14000ed33
mov qword [rbp + 0x158], 0
mov eax, dword [rbp + 8]
inc eax
cdqe
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x158]
call fcn.140113960
mov rcx, qword [rbp + 0x490]
mov qword [rcx + 0xde0], rax
movsxd rax, dword [rbp + 8]
mov qword [rbp + 0x1d8], rax
mov edx, 0x400
lea rcx, [0x14032df00]
call fcn.140001160
mov rcx, qword [rbp + 0x1d8]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x490]
mov r9, qword [rcx + 0xde0]
mov r8, rax
lea rdx, [0x14032def0]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
jmp 0x14000edc4
mov rax, qword [rbp + 0x490]
lea rcx, str.MeshCentral
mov qword [rax + 0xde0], rcx
mov rax, qword [rbp + 0x490]
mov r8, qword [rax + 0xdd8]
lea rdx, str.require_service_manager_.manager.getService__s_.isMe___
mov rcx, qword [rbp + 0x28]
call fcn.14003b050
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x28]
call fcn.140035b70
mov qword [rbp + 0x1e0], rax
mov r9d, 0xe88
xor r8d, r8d
lea rdx, str._function_foo____var_f__require_service_manager_.manager.getServiceType____switch_f_case_procd:_return_7___case_windows:_return_10___case_launchd:_return_3___case_freebsd:_return_5___case_systemd:_return_1___case_init:_return_2___case_upstart:_return_4___default:_return_0_____
mov rcx, qword [rbp + 0x28]
call fcn.1400308b0
test eax, eax
jne 0x14000ee2f
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x28]
call fcn.1400358d0
mov rcx, qword [rbp + 0x490]
mov dword [rcx + 0xdbc], eax
mov r9d, 0xe88
xor r8d, r8d
mov rdx, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x28]
call fcn.1400308b0
test eax, eax
jne 0x14000ee67
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x28]
call fcn.140035660
mov rcx, qword [rbp + 0x490]
mov dword [rcx + 0xdc0], eax
mov r9d, 0xe88
xor r8d, r8d
lea rdx, [0x14032db98]
mov rcx, qword [rbp + 0x28]
call fcn.1400308b0
test eax, eax
jne 0x14000ee9f
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x28]
call fcn.140035660
mov rcx, qword [rbp + 0x490]
mov dword [rcx + 0xdc4], eax
mov rax, qword [rbp + 0x490]
cmp dword [rax + 0xdc0], 0
jne 0x14000f051
mov rax, qword [rbp + 0x490]
cmp dword [rax + 0xde8], 0
je 0x14000f051
mov r9d, 0xe88
xor r8d, r8d
lea rdx, str.require_util_service_check___
mov rcx, qword [rbp + 0x28]
call fcn.1400308b0
test eax, eax
jne 0x14000f051
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x28]
call fcn.140039360
and eax, 6
test eax, eax
je 0x14000ef09
mov dword [rbp + 0xc0], 1
jmp 0x14000ef13
mov dword [rbp + 0xc0], 0
cmp dword [rbp + 0xc0], 0
jne 0x14000f051
lea r8, [rbp + 0x88]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x28]
call fcn.140037fd0
mov qword [rbp + 0x168], rax
mov r8, qword [rbp + 0x168]
mov rax, qword [rbp + 0x490]
mov rdx, qword [rax + 0xdd8]
lea rcx, str.Service_Name_Conflict:_Configured___s__but_is_actually___s_
call fcn.140125090
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0xdd8]
call fcn.140113b40
mov rax, qword [rbp + 0x88]
inc rax
mov ecx, 0xffffffff
cmp rax, rcx
jae 0x14000efd5
mov rax, qword [rbp + 0x88]
inc rax
mov ecx, 0xffffffff
sub rcx, rax
mov rax, rcx
test rax, rax
jbe 0x14000efd5
mov rax, qword [rbp + 0x88]
inc rax
mov ecx, 0xffffffe7
cmp rax, rcx
jae 0x14000efd5
xor eax, eax
cmp eax, 1
je 0x14000efd5
mov rax, qword [rbp + 0x88]
add rax, 0x19
mov rcx, rax
call fcn.14027bb94
mov qword [rbp + 0x160], rax
jmp 0x14000efe0
mov qword [rbp + 0x160], 0
mov eax, dword [rbp + 0x88]
inc eax
cdqe
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x160]
call fcn.140113960
mov rcx, qword [rbp + 0x490]
mov qword [rcx + 0xdd8], rax
mov rax, qword [rbp + 0x490]
mov rax, qword [rax + 0xdd8]
mov r9, qword [rbp + 0x88]
mov r8, qword [rbp + 0x168]
mov rdx, qword [rax - 0x18]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0xdd8]
call fcn.140001020
mov rax, qword [rbp + 0x490]
mov dword [rax + 0xdc0], 1
mov rax, qword [rbp + 0x490]
mov r8, qword [rax + 0xdd8]
lea rdx, str.require__agentNodeId_.checkResetNodeId__s__
mov rcx, qword [rbp + 0x28]
call fcn.14003b050
mov r9d, 0x889
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x28]
call fcn.1400308b0
test eax, eax
jne 0x14000f0c0
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x28]
call fcn.1400394e0
test eax, eax
je 0x14000f0be
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x28]
call fcn.140035660
test eax, eax
je 0x14000f0be
mov dword [rbp + 0x60], 1
lea rcx, str.NodeID_will_reset__because_ResetNodeId_was_set_in_the_registry
call fcn.140125090
jmp 0x14000f0eb
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x28]
call fcn.140037fd0
mov qword [rbp + 0x1e8], rax
mov rdx, qword [rbp + 0x1e8]
lea rcx, str.Error_checking_ResetNodeId_in_registry:__s
call fcn.140125090
mov edx, 0x400
lea rcx, str.skipmaccheck
call fcn.140001160
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14032db18]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
test eax, eax
jne 0x14000f3fb
mov r9d, 0xe88
xor r8d, r8d
lea rdx, str._function__getMac____var_ret____var_ni__require_os_.networkInterfaces____for__var_f_in_ni___for__var_i_in_ni_f____if_ni_f__i_.type__ethernet__ni_f__i_.type__wireless__ret______ni_f__i_.mac________return_ret_______
mov rcx, qword [rbp + 0x28]
call fcn.1400308b0
test eax, eax
jne 0x14000f3fb
lea r8, [rbp + 0x80]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x28]
call fcn.1400359f0
mov qword [rbp + 0xa0], rax
cmp qword [rbp + 0x80], 0x13
jb 0x14000f3fb
mov edx, 0x400
lea rcx, str.LocalMacAddresses
call fcn.140001160
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14032dae0]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
jne 0x14000f1f3
movsxd rax, dword [rbp + 0x80]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0xa0]
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, [0x14032dac0]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012cd50
jmp 0x14000f3fb
mov dword [rbp + 0x18], 0
mov eax, dword [rbp + 0x80]
cmp dword [rbp + 0x18], eax
jge 0x14000f23c
movsxd rax, dword [rbp + 0x18]
mov rcx, qword [rbp + 0xa0]
add rcx, rax
mov rax, rcx
mov r8d, reloc.WS2_32.dll_send
lea rdx, str._00:00:00:00:00:00_
mov rcx, rax
call fcn.140279b30
test eax, eax
je 0x14000f231
jmp 0x14000f23c
mov eax, dword [rbp + 0x18]
add eax, 0x13
mov dword [rbp + 0x18], eax
jmp 0x14000f1fa
mov eax, dword [rbp + 0x80]
cmp dword [rbp + 0x18], eax
jge 0x14000f3fb
mov dword [rbp + 0x18], 0
mov eax, dword [rbp + 0x44]
inc eax
cdqe
mov ecx, 0xffffffc7
cmp rax, rcx
jae 0x14000f2a1
mov eax, dword [rbp + 0x44]
inc eax
cdqe
add rax, 0x38
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x14000f284
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14026deb0
sub rsp, rax
lea rax, [rsp + 0x50]
mov qword [rbp + 0x170], rax
jmp 0x14000f2ac
mov qword [rbp + 0x170], 0
mov eax, dword [rbp + 0x44]
inc eax
cdqe
mov r9d, 1
mov r8d, 8
mov rdx, rax
mov rcx, qword [rbp + 0x170]
call fcn.140113960
mov rcx, rax
call fcn.140113430
mov qword [rbp + 0xf0], rax
movsxd rax, dword [rbp + 0x44]
mov qword [rbp + 0x1f0], rax
mov edx, 0x400
lea rcx, [0x14032da88]
call fcn.140001160
mov rcx, qword [rbp + 0x1f0]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0xf0]
mov r8, rax
lea rdx, [0x14032da68]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov eax, dword [rbp + 0x44]
cmp dword [rbp + 0x18], eax
jge 0x14000f399
movsxd rax, dword [rbp + 0x18]
mov rcx, qword [rbp + 0xf0]
add rcx, rax
mov rax, rcx
mov r8d, reloc.WS2_32.dll_send
lea rdx, [0x14032da50]
mov rcx, rax
call fcn.140279b30
test eax, eax
je 0x14000f38e
movsxd rax, dword [rbp + 0x18]
mov rcx, qword [rbp + 0xf0]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rbp + 0x80]
mov r9d, reloc.WS2_32.dll_send
mov r8, rax
mov rdx, rcx
mov rcx, qword [rbp + 0xa0]
call fcn.1401237f0
test eax, eax
jl 0x14000f38e
jmp 0x14000f399
mov eax, dword [rbp + 0x18]
add eax, 0x13
mov dword [rbp + 0x18], eax
jmp 0x14000f326
mov eax, dword [rbp + 0x44]
cmp dword [rbp + 0x18], eax
jl 0x14000f3fb
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xa0]
lea rcx, str.NodeID_will_reset__MAC_Address_Mismatch:__s_____s
call fcn.140125090
mov dword [rbp + 0x60], 1
movsxd rax, dword [rbp + 0x80]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0xa0]
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, [0x14032d9f8]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012cd50
mov rcx, qword [rbp + 0x28]
call fcn.1400c98a0
cmp dword [rbp + 0x60], 1
je 0x14000f41a
mov rcx, qword [rbp + 0x490]
call fcn.140005a30
test eax, eax
je 0x14000f438
xor edx, edx
mov rcx, qword [rbp + 0x490]
call fcn.1400050d0
test eax, eax
je 0x14000f438
lea rcx, str.Certificate_error_r_n
call fcn.1400012d0
mov rcx, qword [rbp + 0x490]
call fcn.140006110
test eax, eax
je 0x14000f454
lea rcx, str.Certificate_validation_error_r_n
call fcn.1400012d0
mov qword [rbp + 0xf8], 0
xor r8d, r8d
lea rdx, str..tag
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x38]
call fcn.140004e00
mov r8d, 0x1000
lea rdx, [rbp + 0xf8]
mov rcx, rax
call fcn.1401103a0
mov dword [rbp + 0x124], eax
cmp qword [rbp + 0xf8], 0
je 0x14000f4e5
movsxd rax, dword [rbp + 0x124]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0xf8]
mov r8d, 3
lea rdx, [0x14032d0dc]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012cd50
mov rcx, qword [rbp + 0xf8]
call fcn.14027a7c0
jmp 0x14000f502
mov r8d, 3
lea rdx, [0x14032d08c]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012e060
mov qword [rsp + 0x20], 0xff
lea r9, [rbp + 0x360]
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, [0x14032d9a8]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
test eax, eax
jne 0x14000f5ee
mov qword [rbp + 0x100], 0
xor r8d, r8d
lea rdx, str..proxy
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x38]
call fcn.140004e00
mov r8d, 0x400
lea rdx, [rbp + 0x100]
mov rcx, rax
call fcn.1401103a0
mov dword [rbp + 0xc4], eax
cmp qword [rbp + 0x100], 0
je 0x14000f5ee
cmp dword [rbp + 0xc4], 0
jle 0x14000f5c5
movsxd rax, dword [rbp + 0xc4]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x100]
mov r8d, 8
lea rdx, [0x14032d988]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012cd50
jmp 0x14000f5e2
mov r8d, 8
lea rdx, [0x14032d968]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012e060
mov rcx, qword [rbp + 0x100]
call fcn.14027a7c0
mov dword [rbp + 0x50], 0
mov edx, 0x400
lea rcx, str.AgentCapabilities
call fcn.140001160
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14032d928]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
cmp eax, 4
jne 0x14000f694
mov edx, 0x400
lea rcx, [0x14032d908]
call fcn.140001160
mov qword [rsp + 0x20], 4
lea r9, [rbp + 0x50]
mov r8, rax
lea rdx, [0x14032d8e8]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov ecx, dword [rbp + 0x50]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbp + 0x50], eax
mov rax, qword [rbp + 0x490]
mov ecx, dword [rbp + 0x50]
mov eax, dword [rax + 0x298]
or eax, ecx
mov rcx, qword [rbp + 0x490]
mov dword [rcx + 0x298], eax
mov rax, qword [rbp + 0x490]
mov r9, qword [rax + 0xdd8]
lea r8, str.SoftwareOpen_Source_s
xor edx, edx
xor ecx, ecx
call fcn.140001480
cdqe
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0x70]
inc rax
mov ecx, 0xffffffff
cmp rax, rcx
jae 0x14000f711
mov rax, qword [rbp + 0x70]
inc rax
mov ecx, 0xffffffff
sub rcx, rax
mov rax, rcx
test rax, rax
jbe 0x14000f711
mov rax, qword [rbp + 0x70]
inc rax
mov ecx, 0xffffffe7
cmp rax, rcx
jae 0x14000f711
xor eax, eax
cmp eax, 1
je 0x14000f711
mov rax, qword [rbp + 0x70]
add rax, 0x19
mov rcx, rax
call fcn.14027bb94
mov qword [rbp + 0x178], rax
jmp 0x14000f71c
mov qword [rbp + 0x178], 0
mov eax, dword [rbp + 0x70]
inc eax
cdqe
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x178]
call fcn.140113960
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x490]
mov r9, qword [rax + 0xdd8]
lea r8, [0x14032d8b8]
mov rax, qword [rbp + 0xa8]
mov rdx, qword [rax - 0x18]
mov rcx, qword [rbp + 0xa8]
call fcn.140001480
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, qword [rbp + 0xa8]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
inc eax
cdqe
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
add rax, rax
mov ecx, 0xffffffff
cmp rax, rcx
jae 0x14000f7f8
mov rax, qword [rbp + 0x68]
add rax, rax
mov ecx, 0xffffffff
sub rcx, rax
mov rax, rcx
test rax, rax
jbe 0x14000f7f8
mov rax, qword [rbp + 0x68]
add rax, rax
mov ecx, 0xffffffe7
cmp rax, rcx
jae 0x14000f7f8
xor eax, eax
cmp eax, 1
je 0x14000f7f8
mov rax, qword [rbp + 0x68]
lea rax, [rax + rax + 0x18]
mov rcx, rax
call fcn.14027bb94
mov qword [rbp + 0x180], rax
jmp 0x14000f803
mov qword [rbp + 0x180], 0
movsxd rax, dword [rbp + 0x68]
shl rax, 1
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x180]
call fcn.140113960
mov qword [rbp + 0x128], rax
cmp qword [rbp + 0x68], 0x7fffffff
jae 0x1400100a1
cmp qword [rbp + 0x70], 0x7fffffff
ja 0x1400100a1
mov eax, dword [rbp + 0x68]
inc eax
mov r9d, eax
mov r8, qword [rbp + 0x128]
mov edx, dword [rbp + 0x70]
mov rcx, qword [rbp + 0xa8]
call fcn.140112d50
mov rax, qword [rbp + 0x490]
cmp dword [rax + 0xdfc], 0
jne 0x14000f87d
mov qword [rbp + 0x188], 0xffffffff80000002
jmp 0x14000f888
mov qword [rbp + 0x188], 0xffffffff80000001
lea r8, [rbp + 0x38]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1400100a1
mov qword [rbp + 0x10], 0
mov rax, qword [rbp + 0x490]
mov eax, dword [rax + 0x298]
and eax, 0x40
test eax, eax
jne 0x14000fec8
mov rax, qword [rbp + 0x490]
add rax, 0xd54
lea r8, [rbp + 0x10]
mov edx, 0x30
mov rcx, rax
call fcn.1401200f0
mov dword [rbp + 0xc], eax
cmp dword [rbp + 0xc], 0
jle 0x14000f992
cmp qword [rbp + 0x10], 0
je 0x14000f992
mov dword [rbp + 4], 0
jmp 0x14000f90f
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov eax, dword [rbp + 0xc]
cmp dword [rbp + 4], eax
jge 0x14000f955
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x10]
movsx eax, byte [rcx + rax]
cmp eax, 0x2b
jne 0x14000f936
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x10]
mov byte [rcx + rax], 0x40
jmp 0x14000f953
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x10]
movsx eax, byte [rcx + rax]
cmp eax, 0x2f
jne 0x14000f953
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x10]
mov byte [rcx + rax], 0x24
jmp 0x14000f907
mov eax, dword [rbp + 0xc]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.NodeId
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x10]
call fcn.14027a7c0
mov qword [rbp + 0x10], 0
jmp 0x14000f9a3
lea rdx, [0x14032d4cc]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rax, qword [rbp + 0x490]
add rax, 0xc10
lea r8, [0x1403bdcc0]
mov edx, 0x30
mov rcx, rax
call fcn.14010fda0
lea rax, [0x1403bdcc0]
mov qword [rbp + 0x1f8], rax
mov qword [rbp + 0x108], 0xffffffffffffffff
inc qword [rbp + 0x108]
mov rax, qword [rbp + 0x1f8]
mov rcx, qword [rbp + 0x108]
cmp byte [rax + rcx], 0
jne 0x14000f9dd
mov rax, qword [rbp + 0x108]
mov dword [rsp + 0x28], eax
lea rax, [0x1403bdcc0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.AgentHash
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 0x400
lea rcx, [0x14032d444]
call fcn.140001160
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14032d42c]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
test eax, eax
jne 0x14000fa7a
lea rdx, str.MeshId
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x14000fba5
mov edx, 0x400
lea rcx, [0x14032d2b4]
call fcn.140001160
mov qword [rsp + 0x20], 0x10000
lea r9, [0x1403becc0]
mov r8, rax
lea rdx, [0x14032d21c]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov dword [rbp + 0xc], eax
cmp dword [rbp + 0xc], 0
jle 0x14000fb94
lea r8, [rbp + 0x10]
mov edx, dword [rbp + 0xc]
lea rcx, [0x1403becc0]
call fcn.1401200f0
mov dword [rbp + 0xc], eax
cmp dword [rbp + 0xc], 0
jle 0x14000fb81
cmp qword [rbp + 0x10], 0
je 0x14000fb81
mov dword [rbp + 4], 0
jmp 0x14000fafe
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov eax, dword [rbp + 0xc]
cmp dword [rbp + 4], eax
jge 0x14000fb44
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x10]
movsx eax, byte [rcx + rax]
cmp eax, 0x2b
jne 0x14000fb25
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x10]
mov byte [rcx + rax], 0x40
jmp 0x14000fb42
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x10]
movsx eax, byte [rcx + rax]
cmp eax, 0x2f
jne 0x14000fb42
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x10]
mov byte [rcx + rax], 0x24
jmp 0x14000faf6
mov eax, dword [rbp + 0xc]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14032d1cc]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x10]
call fcn.14027a7c0
mov qword [rbp + 0x10], 0
jmp 0x14000fb92
lea rdx, [0x14032d134]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x14000fba5
lea rdx, [0x14032d0d4]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [rsp + 0x28], 0x1a
lea rax, [0x14032d878]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.CommitDate
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 0x400
lea rcx, [0x14032d858]
call fcn.140001160
mov qword [rsp + 0x20], 0x10000
lea r9, [0x1403becc0]
mov r8, rax
lea rdx, [0x14032d848]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov dword [rbp + 0x48], eax
cmp dword [rbp + 0x48], 0
jne 0x14000fc2a
lea rdx, str.MeshServerUrl
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x14000fc8f
lea rax, [0x1403becc0]
mov qword [rbp + 0x200], rax
mov qword [rbp + 0x110], 0xffffffffffffffff
inc qword [rbp + 0x110]
mov rax, qword [rbp + 0x200]
mov rcx, qword [rbp + 0x110]
cmp byte [rax + rcx], 0
jne 0x14000fc43
mov rax, qword [rbp + 0x110]
mov dword [rsp + 0x28], eax
lea rax, [0x1403becc0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14032d828]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 0x400
lea rcx, [0x14032d808]
call fcn.140001160
mov qword [rsp + 0x20], 0x10000
lea r9, [0x1403becc0]
mov r8, rax
lea rdx, [0x14032d7e8]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov dword [rbp + 0x48], eax
cmp dword [rbp + 0x48], 0
jne 0x14000fce6
lea rdx, str.MeshServerId
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x14000fd4b
lea rax, [0x1403becc0]
mov qword [rbp + 0x208], rax
mov qword [rbp + 0x118], 0xffffffffffffffff
inc qword [rbp + 0x118]
mov rax, qword [rbp + 0x208]
mov rcx, qword [rbp + 0x118]
cmp byte [rax + rcx], 0
jne 0x14000fcff
mov rax, qword [rbp + 0x118]
mov dword [rsp + 0x28], eax
lea rax, [0x1403becc0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14032d7c8]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 0x400
lea rcx, [0x14032d7a8]
call fcn.140001160
mov qword [rsp + 0x20], 0x10000
lea r9, [0x1403becc0]
mov r8, rax
lea rdx, [0x14032d790]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov dword [rbp + 0x48], eax
cmp dword [rbp + 0x48], 0
jne 0x14000fda2
lea rdx, str.Proxy
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x14000fe07
lea rax, [0x1403becc0]
mov qword [rbp + 0x210], rax
mov qword [rbp + 0xd8], 0xffffffffffffffff
inc qword [rbp + 0xd8]
mov rax, qword [rbp + 0x210]
mov rcx, qword [rbp + 0xd8]
cmp byte [rax + rcx], 0
jne 0x14000fdbb
mov rax, qword [rbp + 0xd8]
mov dword [rsp + 0x28], eax
lea rax, [0x1403becc0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14032d1c4]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 0x400
lea rcx, [0x14032d03c]
call fcn.140001160
mov qword [rsp + 0x20], 0x10000
lea r9, [0x1403becc0]
mov r8, rax
lea rdx, [0x14032d02c]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov dword [rbp + 0x48], eax
cmp dword [rbp + 0x48], 0
jne 0x14000fe5e
lea rdx, [0x14032d01c]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x14000fec3
lea rax, [0x1403becc0]
mov qword [rbp + 0x218], rax
mov qword [rbp + 0xe0], 0xffffffffffffffff
inc qword [rbp + 0xe0]
mov rax, qword [rbp + 0x218]
mov rcx, qword [rbp + 0xe0]
cmp byte [rax + rcx], 0
jne 0x14000fe77
mov rax, qword [rbp + 0xe0]
mov dword [rsp + 0x28], eax
lea rax, [0x1403becc0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14032cfdc]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x14000ffa3
mov rax, qword [rbp + 0x490]
add rax, 0xd54
lea r8, [rbp + 0x10]
mov edx, 0x30
mov rcx, rax
call fcn.1401200f0
mov dword [rbp + 0xc], eax
cmp dword [rbp + 0xc], 0
jle 0x14000ff92
cmp qword [rbp + 0x10], 0
je 0x14000ff92
mov dword [rbp + 4], 0
jmp 0x14000ff0f
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov eax, dword [rbp + 0xc]
cmp dword [rbp + 4], eax
jge 0x14000ff55
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x10]
movsx eax, byte [rcx + rax]
cmp eax, 0x2b
jne 0x14000ff36
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x10]
mov byte [rcx + rax], 0x40
jmp 0x14000ff53
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x10]
movsx eax, byte [rcx + rax]
cmp eax, 0x2f
jne 0x14000ff53
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x10]
mov byte [rcx + rax], 0x24
jmp 0x14000ff07
mov eax, dword [rbp + 0xc]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.DiagnosticAgentNodeId
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x10]
call fcn.14027a7c0
mov qword [rbp + 0x10], 0
jmp 0x14000ffa3
lea rdx, [0x14032d760]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, 0x400
lea rcx, [0x14032d750]
call fcn.140001160
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14032d740]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
test eax, eax
jne 0x140010097
mov dword [rbp + 0x54], 0
mov edx, 0x400
lea rcx, str.NodeID
call fcn.140001160
mov qword [rsp + 0x20], 0x1000
lea r9, [0x1403bdcc0]
mov r8, rax
lea rdx, [0x14032d014]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 0
je 0x140010058
cmp dword [rbp + 0x54], 0x30
jne 0x140010058
movsxd rax, dword [rbp + 0x54]
mov rcx, qword [rbp + 0x490]
add rcx, 0xd54
mov r8, rax
lea rdx, [0x1403bdcc0]
call fcn.140270070
test eax, eax
je 0x140010097
mov rax, qword [rbp + 0x490]
add rax, 0xd54
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x30
mov r9, rax
mov r8d, 6
lea rdx, [0x14032cfd4]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012cd50
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0xa8]
call fcn.140113b40
mov rcx, qword [rbp + 0x128]
call fcn.140113b40
mov rax, qword [rbp + 0x490]
cmp qword [rax + 0xc98], 0
jne 0x1400100e8
lea r9, [0x14000ca10]
xor r8d, r8d
xor edx, edx
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x40]
call fcn.140135190
jmp 0x14001011d
mov rax, qword [rbp + 0x490]
add rax, 0xc98
lea r9, [0x14000ca10]
mov rcx, qword [rbp + 0x490]
mov r8, qword [rcx + 0xc80]
mov rdx, rax
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x40]
call fcn.140135190
cmp dword [rbp + 0x4a8], 0
je 0x1400101bc
cmp dword [rbp + 0x498], 1
je 0x1400101bc
cmp dword [rbp + 0x498], 2
jne 0x140010f78
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x4a0]
mov rax, qword [rcx + rax]
lea rcx, [0x14032cfac]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x140010175
inc rax
test dl, dl
jne 0x140010162
xor eax, eax
jmp 0x14001017a
sbb eax, eax
or eax, 1
test eax, eax
je 0x1400101bc
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x4a0]
mov rax, qword [rcx + rax]
lea rcx, [0x14032d738]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x1400101af
inc rax
test dl, dl
jne 0x14001019c
xor eax, eax
jmp 0x1400101b4
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140010f78
xor r8d, r8d
lea rdx, [0x14032d728]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x38]
call fcn.140004e00
mov qword [rbp + 0xe8], rax
mov rcx, qword [rbp + 0xe8]
call fcn.140110530
xor r8d, r8d
lea rdx, str..corereset
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x38]
call fcn.140004e00
mov qword [rbp + 0xe8], rax
mov rcx, qword [rbp + 0xe8]
call fcn.14012cab0
test eax, eax
je 0x140010251
mov edx, 0x400
lea rcx, [0x14032d708]
call fcn.140001160
mov r8, rax
lea rdx, [0x14032d6f8]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012e060
mov rcx, qword [rbp + 0xe8]
call fcn.140110530
mov rax, qword [rbp + 0x490]
cmp dword [rax + 0x28c], 0
jne 0x1400102a0
mov edx, 0x400
lea rcx, [0x14032d6e8]
call fcn.140001160
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14032d6d8]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov dword [rbp + 0xc8], eax
jmp 0x1400102aa
mov dword [rbp + 0xc8], 0
mov eax, dword [rbp + 0xc8]
mov dword [rbp + 0x30], eax
mov edx, 0x400
lea rcx, str.jsDebugPort
call fcn.140001160
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14032d6b8]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
test eax, eax
je 0x1400103ba
mov edx, 0x400
lea rcx, [0x14032d6a8]
call fcn.140001160
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rbp + 0x350]
mov r8, rax
lea rdx, [0x14032d698]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jle 0x1400103ba
cmp dword [rbp + 0x64], 0x10
jge 0x1400103ba
movsxd rax, dword [rbp + 0x64]
mov qword [rbp + 0x190], rax
cmp qword [rbp + 0x190], 0x10
jae 0x140010357
jmp 0x14001035c
call fcn.14026da68
mov rax, qword [rbp + 0x190]
mov byte [rbp + rax + 0x350], 0
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0x350]
call fcn.140113d10
cmp rax, 0x7fffffff
ja 0x14001039d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0x350]
call fcn.140113d50
mov dword [rbp + 0xcc], eax
jmp 0x1400103a7
mov dword [rbp + 0xcc], 0
mov rax, qword [rbp + 0x490]
mov ecx, dword [rbp + 0xcc]
mov dword [rax + 0xc00], ecx
mov rax, qword [rbp + 0x490]
mov dword [rax + 0x290], 1
mov edx, 0x400
lea rcx, str.showModuleNames
call fcn.140001160
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14032d678]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov dword [0x1403b8d04], eax
mov rax, qword [rbp + 0x490]
cmp qword [rax + 0x10], 0
je 0x1400104b5
mov rax, qword [rbp + 0x490]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.140004210
lea r8, [0x14032d670]
mov edx, 0xffffffff
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.140031be0
mov edx, 0xfffffffe
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.140034750
lea rdx, [0x14032d00c]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.14003a550
mov edx, 1
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.14002f170
test eax, eax
je 0x1400104a5
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.1400c97c0
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.14003d530
mov rax, qword [rbp + 0x490]
cmp dword [rax + 0x28c], 0
jne 0x1400108a5
call fcn.1400fcc30
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov rcx, qword [rbp + 0x490]
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rbp + 0x490]
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbp + 0x490]
mov rcx, qword [rcx + 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x490]
mov r9, qword [rcx]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400fd9f0
mov rcx, qword [rbp + 0x490]
mov qword [rcx + 0x10], rax
mov r8, qword [rbp + 0x490]
mov rax, qword [rbp + 0x490]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.140004d90
mov r8, qword [rbp + 0x490]
lea rdx, [0x14000d3b0]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.1400c9360
mov edx, 0x400
lea rcx, str.coreDumpEnabled
call fcn.140001160
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14032d650]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov dword [rbp + 0x90], eax
mov rax, qword [rbp + 0x490]
mov ecx, dword [rbp + 0x90]
mov dword [rax + 0xc04], ecx
cmp dword [rbp + 0x90], 0
je 0x1400105f3
mov r9d, 0xf08
xor r8d, r8d
lea rdx, str.process.coreDumpLocation__process.platformwin32__process.execPath.replace_.exe__.dmp__:_process.execPath__.dmp__
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.1400308b0
mov edx, 0x400
lea rcx, str.finalizer_messages
call fcn.140001160
mov qword [rsp + 0x20], 0x1000
lea r9, [0x1403bdcc0]
mov r8, rax
lea rdx, [0x14032d5a0]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
test eax, eax
je 0x140010644
lea rcx, [0x1403bdcc0]
call fcn.14027b518
mov dword [0x1403b9568], eax
cmp dword [rbp + 0x30], 4
jle 0x1400108a5
mov edx, 0x400
lea rcx, str.noUpdateCoreModule
call fcn.140001160
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14032d570]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
test eax, eax
je 0x1400107f1
mov rax, qword [rbp + 0x490]
mov dword [rax + 0x28c], 1
lea rcx, str._CoreModule:_Update_Disabled_n
call fcn.1400012d0
movsxd rax, dword [rbp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140113f90
mov qword [rbp + 0x78], rax
movsxd rax, dword [rbp + 0x30]
mov qword [rbp + 0x220], rax
mov edx, 0x400
lea rcx, [0x14032d530]
call fcn.140001160
mov rcx, qword [rbp + 0x220]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x78]
mov r8, rax
lea rdx, [0x14032d520]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov eax, dword [rbp + 0x30]
sub eax, 4
mov rcx, qword [rbp + 0x78]
add rcx, 4
mov dword [rsp + 0x20], reloc.WS2_32.dll_listen
lea r9, [0x14032d510]
mov r8d, eax
mov rdx, rcx
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.1400fe210
test eax, eax
jne 0x140010757
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.1400fe350
test eax, eax
je 0x1400107e3
mov rax, qword [rbp + 0x490]
cmp qword [rax], 0
je 0x14001078d
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rbp + 0x490]
add rax, qword [rcx]
mov ecx, 8
imul rcx, rcx, 0
mov rax, qword [rax + rcx]
mov qword [rbp + 0x198], rax
jmp 0x140010798
mov qword [rbp + 0x198], 0
xor r8d, r8d
mov edx, 0xffffffff
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.140037fd0
mov qword [rsp + 0x20], rax
lea r9, [0x14032d4f0]
mov r8d, 2
mov edx, 0x4100
mov rcx, qword [rbp + 0x198]
call fcn.140129b00
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.14003d530
mov rcx, qword [rbp + 0x78]
call fcn.14027a7c0
jmp 0x1400108a5
mov rax, qword [rbp + 0x490]
mov qword [rbp + 0x228], rax
lea rax, [0x14000d650]
mov qword [rsp + 0x20], rax
mov r9d, 0xea60
mov r8d, 1
lea rdx, [rbp + 0x228]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.1400c9f80
mov rcx, qword [rbp + 0x490]
mov qword [rcx + 0xbf8], rax
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.14003ad10
mov rax, qword [rbp + 0x490]
mov rdx, qword [rax + 0xbf8]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.14003cc30
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0xbf8]
call fcn.1400c8790
mov r8, rax
mov edx, 0xfffffffe
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.1400320c0
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.14003d530
mov edx, 0x400
lea rcx, str.exitPID
call fcn.140001160
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14032d4e0]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
test eax, eax
jle 0x14001099c
mov edx, 0x400
lea rcx, [0x14032d4d8]
call fcn.140001160
mov qword [rsp + 0x20], 0x1000
lea r9, [0x1403bdcc0]
mov r8, rax
lea rdx, [0x14032d378]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov dword [rbp + 0x1b0], eax
mov edx, 0x1000
lea rcx, [0x1403bdcc0]
call fcn.140113d50
mov r8d, eax
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x1a0], rax
cmp qword [rbp + 0x1a0], 0
je 0x14001099c
mov edx, 0x1561
lea rcx, [0x14032d490]
call fcn.1401191d0
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x490]
mov qword [rsp + 0x20], rax
lea r9, [0x14000d890]
mov r8d, 0xffffffff
mov rdx, qword [rbp + 0x1a0]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax]
call fcn.14011a510
mov edx, 0x400
lea rcx, str.hideConsole
call fcn.140001160
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14032d470]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
test eax, eax
jle 0x140010a05
mov rax, qword [rbp + 0x490]
cmp qword [rax + 0x10], 0
je 0x140010a05
mov r9d, 0xf88
xor r8d, r8d
lea rdx, str.require_win_console_.hide__
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.1400308b0
mov edx, 0x400
lea rcx, [0x14032d438]
call fcn.140001160
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14032d420]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
test eax, eax
jne 0x140010a5d
mov r8, qword [rbp + 0x490]
lea rdx, [0x14000d3e0]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax]
call fcn.1401115a0
mov rax, qword [rbp + 0x490]
cmp dword [rax + 0xc0c], 0
jne 0x140010a7e
mov rcx, qword [rbp + 0x490]
call fcn.14000c2e0
jmp 0x140010c20
mov edx, 0x400
lea rcx, [0x14032d410]
call fcn.140001160
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14032d400]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov dword [rbp + 0x30], eax
cmp dword [rbp + 0x30], 4
jle 0x140010c00
movsxd rax, dword [rbp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140113f90
mov qword [rbp + 0x78], rax
movsxd rax, dword [rbp + 0x30]
mov qword [rbp + 0x230], rax
mov edx, 0x400
lea rcx, [0x14032d3f0]
call fcn.140001160
mov rcx, qword [rbp + 0x230]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x78]
mov r8, rax
lea rdx, [0x14032d3e0]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov eax, dword [rbp + 0x30]
sub eax, 4
mov rcx, qword [rbp + 0x78]
add rcx, 4
mov dword [rsp + 0x20], reloc.WS2_32.dll_listen
lea r9, [0x14032d368]
mov r8d, eax
mov rdx, rcx
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.1400fe210
test eax, eax
jne 0x140010b6b
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.1400fe350
test eax, eax
je 0x140010be7
mov rax, qword [rbp + 0x490]
cmp qword [rax], 0
je 0x140010ba1
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rbp + 0x490]
add rax, qword [rcx]
mov ecx, 8
imul rcx, rcx, 0
mov rax, qword [rax + rcx]
mov qword [rbp + 0x1a8], rax
jmp 0x140010bac
mov qword [rbp + 0x1a8], 0
xor r8d, r8d
mov edx, 0xffffffff
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.140037fd0
mov qword [rsp + 0x20], rax
lea r9, [0x14032d348]
mov r8d, 2
mov edx, 0x4100
mov rcx, qword [rbp + 0x1a8]
call fcn.140129b00
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.14003d530
mov rcx, qword [rbp + 0x78]
call fcn.14027a7c0
mov r9d, 0xf88
xor r8d, r8d
lea rdx, str.console.log_Agent_running_in_Local_Debug_Mode__require_MeshAgent_.emit_Connected_1__
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x10]
call fcn.1400308b0
mov edx, 0x400
lea rcx, [0x14032d338]
call fcn.140001160
mov qword [rsp + 0x20], 0x1000
lea r9, [0x1403bdcc0]
mov r8, rax
lea rdx, [0x14032d328]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
cmp eax, 5
jle 0x140010f71
mov r8d, 5
lea rdx, [0x14032cfcc]
lea rcx, [0x1403bdcc0]
call fcn.140270070
test eax, eax
jne 0x140010f71
mov edx, 0x400
lea rcx, str.DiscoveryKey
call fcn.140001160
mov qword [rsp + 0x20], 0x1000
lea r9, [0x1403bdcc0]
mov r8, rax
lea rdx, [0x14032d308]
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax + 0x48]
call fcn.14012d540
mov dword [rbp + 0x94], eax
cmp dword [rbp + 0x94], 1
jle 0x140010dab
lea rcx, [rbp + 0x270]
call fcn.140162970
mov eax, dword [rbp + 0x94]
dec eax
cdqe
mov r8, rax
lea rdx, [0x1403bdcc0]
lea rcx, [rbp + 0x270]
call fcn.140162a00
lea rdx, [rbp + 0x270]
lea rcx, [0x1403bdcc0]
call fcn.140162950
mov ecx, 0x20
call fcn.14027bb94
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x490]
mov rcx, qword [rbp + 0x130]
mov qword [rax + 0xda0], rcx
cmp qword [rbp + 0x130], 0
jne 0x140010d89
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x1592
lea rdx, [0x14032d2c0]
xor ecx, ecx
call fcn.140124df0
mov r8d, 0x1592
lea rdx, [0x14032d278]
lea rcx, [0x14032d250]
call fcn.1400012d0
mov ecx, 0xfe
call fcn.1402742dc
mov rax, qword [rbp + 0x490]
mov rax, qword [rax + 0xda0]
lea rcx, [0x1403bdcc0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x238]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosb byte [rdi], al
lea rax, [rbp + 0x248]
mov rdi, rax
xor eax, eax
mov ecx, 0x1c
rep stosb byte [rdi], al
call fcn.140124450
test eax, eax
je 0x140010e0f
mov eax, reloc.WS2_32.dll_socket
mov word [rbp + 0x248], ax
mov cx, 0x425d
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x24a], ax
lea r8, [rbp + 0x250]
lea rdx, str.FF02:0:0:0:0:0:0:FE
mov ecx, reloc.WS2_32.dll_socket
call fcn.140124780
mov eax, 2
mov word [rbp + 0x238], ax
mov cx, 0x425d
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x23a], ax
lea r8, [rbp + 0x23c]
lea rdx, str.239.255.255.235
mov ecx, 2
call fcn.140124780
mov dword [rsp + 0x38], 1
mov rax, qword [rbp + 0x490]
mov qword [rsp + 0x30], rax
lea rax, [0x140001770]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x248]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x238]
mov r8w, 0x425e
mov edx, 0x400
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax]
call fcn.140112440
mov rcx, qword [rbp + 0x490]
mov qword [rcx + 0xd90], rax
mov rax, qword [rbp + 0x490]
cmp qword [rax + 0xd90], 0
jne 0x140010edd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xdb
mov r8d, 0x15aa
lea rdx, [0x14032d1d8]
xor ecx, ecx
call fcn.140124df0
mov eax, 1
jmp 0x140010f7a
mov dword [rsp + 0x38], 1
mov rax, qword [rbp + 0x490]
mov qword [rsp + 0x30], rax
lea rax, [0x140001770]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x248]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x238]
xor r8d, r8d
mov edx, 0x400
mov rax, qword [rbp + 0x490]
mov rcx, qword [rax]
call fcn.140112440
mov rcx, qword [rbp + 0x490]
mov qword [rcx + 0xd98], rax
mov rax, qword [rbp + 0x490]
cmp qword [rax + 0xd98], 0
jne 0x140010f71
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xdb
mov r8d, 0x15ae
lea rdx, [0x14032d188]
xor ecx, ecx
call fcn.140124df0
mov eax, 1
jmp 0x140010f7a
mov eax, 1
jmp 0x140010f7a
xor eax, eax
mov rcx, qword [rbp + 0x460]
xor rcx, rbp
call fcn.14026d940
lea rsp, [rbp + 0x470]
pop rdi
pop rsi
pop rbp
ret