Function at 0x14000b1dc
Capabilities:
Create process on windows
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1450]
mov eax, 0x1550
call fcn.1401bc6a0
sub rsp, rax
mov rax, qword [0x1402b1ed0]
xor rax, rsp
mov qword [rbp + 0x1440], rax
mov rdi, qword [0x1402b5548]
lea rcx, [rbp]
xor r13d, r13d
mov r14, r8
mov edx, 0x400
mov esi, r13d
lea r9d, [r13 + 1]
lea r8d, [r13 + 8]
call fcn.14008de4c
mov rbx, rax
cmp qword [rax - 0x10], r13
jbe 0x14000b24f
lea rcx, [rax + 0x18]
add rcx, qword [rax - 0x18]
jmp 0x14000b252
mov rcx, r13
mov qword [rcx], rdi
mov rax, qword [rdi + 0x78]
test rax, rax
je 0x14000b267
mov ecx, 2
call rax
jmp 0x14000b26d
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
cmp dword [rbp + 0x1498], 1
jne 0x14000b289
mov rcx, qword [r14]
lea rdx, str.__slave
call fcn.1401d0500
test eax, eax
je 0x14000b2a6
cmp dword [rbp + 0x1498], 2
jne 0x14000b2f4
mov rcx, qword [r14 + 8]
lea rdx, str.__slave
call fcn.1401d0500
test eax, eax
jne 0x14000b2b3
mov rcx, rdi
call fcn.1400079f0
jmp 0x14000baf8
mov rcx, qword [r14 + 8]
lea rdx, str.__netinfo
call fcn.1401d0500
test eax, eax
jne 0x14000b2f4
lea rcx, [rsp + 0x50]
call fcn.140010084
test eax, eax
jle 0x14000baf8
mov rdx, qword [rsp + 0x50]
lea rcx, str._s_r_n
call fcn.140001090
mov rcx, qword [rsp + 0x50]
jmp 0x14000baf3
cmp qword [rdi + 0x38], r13
jne 0x14000b344
mov qword [rdi + 0x38], rbx
lea rdx, [rbp + 0x440]
mov r8d, 0x800
mov byte [rbx], r13b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [rbx - 0x18]
lea r8, [rbp + 0x440]
mov qword [rsp + 0x38], r13
or r9d, 0xffffffff
mov qword [rsp + 0x30], r13
xor edx, edx
mov dword [rsp + 0x28], eax
mov ecx, 0xfde9
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rdi + 0x38]
lea rdx, [rdi + 0xa04]
call fcn.140003d64
mov r15d, 1
cmp dword [rbp + 0x1498], r15d
jle 0x14000b414
lea rbx, [r14 + 8]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14000b378
mov rax, r13
jmp 0x14000b382
mov edx, 0x1000
call fcn.1401c3c94
mov rcx, qword [rbx]
lea r8, [0x140249d14]
movsxd rdx, eax
mov r9d, 1
call fcn.1400954ac
mov r12d, eax
cmp eax, 2
jle 0x14000b3f8
mov rcx, qword [rbx]
lea rdx, [0x140249edc]
mov r8d, 2
call fcn.1401c3870
test eax, eax
jne 0x14000b3f8
cmp r12d, 0xf
jne 0x14000b3f8
mov rcx, qword [rbx]
lea r8d, [rax + 0xd]
add rcx, 2
lea rdx, str.configUsesCWD
call fcn.1401c3870
test eax, eax
jne 0x14000b3f8
mov rcx, qword [rbx]
lea r8d, [r12 - 0xe]
add rcx, 0x10
lea rdx, [0x140249328]
call fcn.1401c3870
test eax, eax
je 0x14000b40d
inc r15d
add rbx, 8
cmp r15d, dword [rbp + 0x1498]
jge 0x14000b414
jmp 0x14000b36b
mov dword [rdi + 0x50], 1
mov rcx, qword [rdi + 0x38]
lea rdx, str..log
xor r8d, r8d
call fcn.14000312c
mov rcx, rax
xor edx, edx
call fcn.1400957a4
mov qword [0x1402b5508], rax
call fcn.14008c2f0
mov rcx, qword [rdi]
lea rdx, [0x140007b18]
mov r8, rdi
call fcn.14008e270
mov rcx, qword [r14]
lea r8, [0x14024896c]
or rdx, 0xffffffffffffffff
call fcn.140095524
test eax, eax
jle 0x14000b4c5
mov r8, qword [r14]
lea r12, [0x1402ba800]
movsxd rbx, eax
mov r15d, 0x10000
mov r9, rbx
mov edx, r15d
mov rcx, r12
call fcn.1401bf230
cmp rbx, r15
jae 0x14000bb24
mov byte [rbx + r12], r13b
or r9d, 0xffffffff
lea rbx, [0x1402b6800]
mov dword [rsp + 0x28], 0x1000
mov r8, r12
mov qword [rsp + 0x20], rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rax, [rbp + 0x1498]
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], r14
cmp qword [rdi + 0x20], r13
jne 0x14000baa2
cmp dword [rbp + 0x1498], 2
jl 0x14000b546
mov rcx, qword [r14 + 8]
lea r8, [0x14024a7b4]
mov r9d, 3
mov dword [rsp + 0x20], 1
or rdx, 0xffffffffffffffff
call fcn.1400953e8
test eax, eax
jne 0x14000baa2
cmp dword [rbp + 0x1498], 2
jl 0x14000b546
mov rcx, qword [r14 + 8]
lea r9d, [rax + 4]
lea r8, str..zip
mov dword [rsp + 0x20], 1
or rdx, 0xffffffffffffffff
call fcn.1400953e8
test eax, eax
jne 0x14000baa2
mov rcx, qword [rdi]
lea r9, [rbp - 0x20]
xor r8d, r8d
lea rdx, [0x14000b1a0]
call fcn.14008e360
mov rcx, qword [rdi]
call fcn.140090cd4
mov qword [rdi], r13
cmp qword [rdi + 0x48], r13
je 0x14000b853
cmp dword [rdi + 0x9d8], r13d
je 0x14000b846
cmp dword [rdi + 0xba0], r13d
jne 0x14000b726
call fcn.1400811e0
mov rbx, qword [rdi + 0x48]
mov rcx, rax
mov r14, rax
call fcn.14001c7a0
mov r8, r14
lea rdx, [0x140086ef0]
mov rcx, rbx
call fcn.140098504
or edx, 0xffffffff
mov rcx, r14
call fcn.14001af40
test rax, rax
je 0x14000b708
or edx, 0xffffffff
mov rcx, r14
call fcn.140018fe0
lea r8, [rsp + 0x50]
or edx, 0xffffffff
mov rcx, r14
call fcn.14001ab00
mov rbx, qword [rsp + 0x50]
mov r12, rax
movabs rax, 0xaaaaaaaaaaaaaaab
lea rcx, [rbx*4 + 4]
mul rcx
mov ecx, 0xfffffffa
lea r15, [rbx + 1]
mov rsi, rdx
shr rsi, 1
sub rcx, rsi
cmp r15, rcx
jae 0x14000b664
mov eax, 0xfffffffe
lea rdx, [rsi + 5]
sub rax, rbx
cmp rdx, rax
jae 0x14000b664
lea rax, [rbx + 6]
mov ecx, 0xffffffe7
add rax, rsi
cmp rax, rcx
jae 0x14000b664
test rdx, rdx
je 0x14000b647
lea rax, [rbx + 0x1e]
add rax, rsi
cmp rax, rcx
jae 0x14000b664
cmp r13, rdx
lea rcx, [rbx + 0x1e]
sbb rax, rax
and eax, 0x18
add rax, rsi
add rcx, rax
call fcn.1401c4328
mov rcx, rax
jmp 0x14000b667
mov rcx, r13
lea eax, [rsi + 5]
xor r9d, r9d
movsxd r8, eax
lea eax, [rbx + 1]
movsxd rdx, eax
call fcn.14008de4c
mov rsi, rax
cmp qword [rax - 0x10], r13
jbe 0x14000b693
lea rdx, [rax + 0x18]
add rdx, qword [rax - 0x18]
mov qword [rsp + 0x50], rdx
jmp 0x14000b698
mov qword [rsp + 0x50], r13
mov r9, rbx
mov r8, r12
mov rdx, r15
mov rcx, rsi
call section..text
mov rcx, r14
call fcn.14005fd48
mov rcx, rsi
cmp rbx, 0x7fffffff
jbe 0x14000b6db
call fcn.14008df34
mov rsi, r13
cmp dword [rdi + 0x9e4], r13d
je 0x14000b846
lea rcx, str._Service_Parameters___ERROR
jmp 0x14000b71c
lea r8, [rsp + 0x50]
mov edx, ebx
call fcn.140093b80
cmp dword [rdi + 0x9e4], r13d
je 0x14000b846
mov rdx, rsi
lea rcx, str._Service_Parameters____s
call fcn.14009631c
jmp 0x14000b846
cmp dword [rdi + 0x9e4], r13d
je 0x14000b846
lea rcx, str._Service_Parameters___NONE
call fcn.14009631c
jmp 0x14000b846
mov rbx, qword [rdi + 0xbb8]
lea rdx, str.Mesh_Agent
mov rcx, rbx
call fcn.1401d0500
test eax, eax
je 0x14000b846
mov r8, qword [rbx - 0x18]
movabs rsi, 0xaaaaaaaaaaaaaaab
mov rax, rsi
lea rcx, [r8*4 + 0x78]
mul rcx
mov ecx, 0xfffffffa
lea rax, [r8 + 0x1e]
shr rdx, 1
sub rcx, rdx
cmp rax, rcx
jae 0x14000b7c5
mov eax, 0xffffffe1
lea r9, [rdx + 5]
sub rax, r8
cmp r9, rax
jae 0x14000b7c5
lea rax, [r8 + 0x23]
mov ecx, 0xffffffe7
add rax, rdx
cmp rax, rcx
jae 0x14000b7c5
test r9, r9
je 0x14000b7a7
lea rax, [r8 + 0x3b]
add rax, rdx
cmp rax, rcx
jae 0x14000b7c5
mov ecx, 0x3b
test r9, r9
lea eax, [rcx + 0x18]
cmovne ecx, eax
add rcx, rdx
add rcx, r8
call fcn.1401c4328
mov r10, rax
jmp 0x14000b7c8
mov r10, r13
mov r9, qword [rdi + 0xbb8]
mov rax, qword [r9 - 0x18]
lea rcx, [rax*4 + 0x78]
mov rax, rsi
mul rcx
mov eax, dword [r9 - 0x18]
mov rcx, r10
shr rdx, 1
add eax, 0x1e
add rdx, 5
xor r9d, r9d
movsxd r8, edx
movsxd rdx, eax
call fcn.14008de4c
mov rsi, rax
cmp qword [rax - 0x10], r13
jbe 0x14000b818
lea rcx, [rax + 0x18]
add rcx, qword [rax - 0x18]
mov qword [rsp + 0x50], rcx
jmp 0x14000b81d
mov qword [rsp + 0x50], r13
mov r9, qword [rdi + 0xbb8]
lea r8, str.____meshServiceName__s___
mov rdx, qword [rax - 0x18]
mov rcx, rsi
call fcn.1400010e4
mov edx, eax
lea r8, [rsp + 0x50]
mov rcx, rsi
call fcn.140093b80
mov rcx, qword [rdi + 0x48]
call fcn.140098f8c
mov qword [rdi + 0x48], r13
cmp dword [rdi + 0x9d8], r13d
je 0x14000bac3
xor edx, edx
mov dword [rsp + 0x70], WSAGetLastError
lea rcx, [rsp + 0x78]
lea r8d, [rdx + 0x60]
call fcn.1401bd600
mov rcx, qword [rdi + 0x38]
lea rdx, str..update.exe
xor r8d, r8d
call fcn.14000312c
mov r14, rax
cmp dword [rdi + 0x9e4], r13d
je 0x14000b8b0
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.SelfUpdate____Updating...
xor edx, edx
call fcn.1400961f4
cmp dword [rdi + 0xba8], r13d
jne 0x14000b8e2
mov rax, qword [rdi + 0x38]
lea rbx, [0x1402b9800]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r9, r14
lea r8, str._s__update:__s_
mov edx, 0x1000
call fcn.1400010e4
jmp 0x14000b944
test rsi, rsi
jne 0x14000b8f0
lea rcx, str.W10
jmp 0x14000b903
cmp qword [rsi - 0x10], r13
jbe 0x14000b900
lea rcx, [rsi + 0x18]
add rcx, qword [rsi - 0x18]
jmp 0x14000b903
mov rcx, r13
cmp dword [rdi + 0xba0], r13d
lea rdx, [0x14024ab20]
mov qword [rsp + 0x28], rcx
lea rax, [0x14024ab24]
cmovne rax, rdx
lea rbx, [0x1402b9800]
mov edx, 0x1000
mov qword [rsp + 0x20], rax
mov r9, r14
lea r8, str._s__update:_s__s
mov rcx, rbx
call fcn.1400010e4
cmp dword [rdi + 0x9e4], r13d
je 0x14000b962
mov edx, dword [rdi + 0xba8]
lea rcx, str.SelfUpdate__d_____CreateProcessW___with_parameters:__s
mov r8, rbx
call fcn.14009631c
lea r12, [0x1402b6800]
mov dword [rsp + 0x28], 0x1000
or r9d, 0xffffffff
mov qword [rsp + 0x20], r12
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x58]
mov r15d, 0x8000000
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rdx, r12
mov qword [rsp + 0x38], r13
xor ecx, ecx
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000ba8a
cmp dword [rdi + 0x9e4], r13d
je 0x14000b9f6
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.SelfUpdate____FAILED...
xor edx, edx
call fcn.1400961f4
test r14, r14
je 0x14000bac3
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x14000bac3
jmp 0x14000ba1d
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rdi + 0x38]
mov rdx, r14
call fcn.14008c24c
test eax, eax
je 0x14000ba0e
mov dword [rsp + 0x28], 0x1000
or r9d, 0xffffffff
mov r8, rbx
mov qword [rsp + 0x20], r12
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
mov rdx, r12
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000bac3
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000bac3
mov rcx, qword [rdi]
lea r9, [rbp - 0x20]
xor r8d, r8d
lea rdx, [0x14000b18c]
call fcn.14008e360
mov rcx, qword [rdi]
call fcn.140090cd4
mov qword [rdi], r13
test rsi, rsi
je 0x14000bad0
mov rcx, rsi
call fcn.14008df34
mov eax, dword [0x1402b54fc]
dec eax
mov dword [0x1402b54fc], eax
test eax, eax
jg 0x14000bae7
call fcn.1400ca1f0
mov rcx, qword [0x1402b5508]
test rcx, rcx
je 0x14000baf8
call fcn.1401c3c8c
xor eax, eax
mov rcx, qword [rbp + 0x1440]
xor rcx, rsp
call fcn.1401bc130
mov rbx, qword [rsp + 0x1590]
add rsp, 0x1550
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1401bc25c
int3