Function at 0x14000ba50
Capabilities:
Create process on windows
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1450]
mov eax, 0x1550
call fcn.1401c1440
sub rsp, rax
mov rax, qword [0x1402bff08]
xor rax, rsp
mov qword [rbp + 0x1440], rax
mov rdi, qword [0x1402c3750]
lea rcx, [rbp]
xor r13d, r13d
mov r14, r8
mov edx, 0x400
mov esi, r13d
lea r9d, [r13 + 1]
lea r8d, [r13 + 8]
call fcn.14008e668
mov rbx, rax
cmp qword [rax - 0x10], r13
jbe 0x14000bac3
lea rcx, [rax + 0x18]
add rcx, qword [rax - 0x18]
jmp 0x14000bac6
mov rcx, r13
mov qword [rcx], rdi
mov rax, qword [rdi + 0x78]
test rax, rax
je 0x14000badb
mov ecx, 2
call rax
jmp 0x14000bae1
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
cmp dword [rbp + 0x1498], 1
jne 0x14000bafd
mov rcx, qword [r14]
lea rdx, str.__slave
call fcn.1401d9f70
test eax, eax
je 0x14000bb1a
cmp dword [rbp + 0x1498], 2
jne 0x14000bb68
mov rcx, qword [r14 + 8]
lea rdx, str.__slave
call fcn.1401d9f70
test eax, eax
jne 0x14000bb27
mov rcx, rdi
call fcn.1400081ac
jmp 0x14000c36a
mov rcx, qword [r14 + 8]
lea rdx, str.__netinfo
call fcn.1401d9f70
test eax, eax
jne 0x14000bb68
lea rcx, [rsp + 0x50]
call fcn.140010794
test eax, eax
jle 0x14000c36a
mov rdx, qword [rsp + 0x50]
lea rcx, str._s_r_n
call fcn.140001090
mov rcx, qword [rsp + 0x50]
jmp 0x14000c365
mov rcx, qword [rdi + 0x38]
test rcx, rcx
jne 0x14000bbbd
mov qword [rdi + 0x38], rbx
lea rdx, [rbp + 0x440]
mov r8d, 0x800
mov byte [rbx], r13b
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [rbx - 0x18]
lea r8, [rbp + 0x440]
mov qword [rsp + 0x38], r13
or r9d, 0xffffffff
mov qword [rsp + 0x30], r13
xor edx, edx
mov dword [rsp + 0x28], eax
mov ecx, 0xfde9
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rdi + 0x38]
lea rdx, [rdi + 0xa04]
call fcn.140004124
mov r15d, 1
cmp dword [rbp + 0x1498], r15d
jle 0x14000bc89
lea rbx, [r14 + 8]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14000bbed
mov rax, r13
jmp 0x14000bbfa
mov edx, 0x1000
call fcn.1401ccb7c
mov rcx, qword [rbx]
movsxd rdx, eax
lea r8, [0x14025547c]
mov r9d, 1
call fcn.140096480
mov r12d, eax
cmp eax, 2
jle 0x14000bc6d
mov rcx, qword [rbx]
lea rdx, [0x14025566c]
mov r8d, 2
call fcn.1401cca10
test eax, eax
jne 0x14000bc6d
cmp r12d, 0xf
jne 0x14000bc6d
mov rcx, qword [rbx]
lea r8d, [rax + 0xd]
add rcx, 2
lea rdx, str.configUsesCWD
call fcn.1401cca10
test eax, eax
jne 0x14000bc6d
mov rcx, qword [rbx]
lea r8d, [r12 - 0xe]
add rcx, 0x10
lea rdx, [0x1402547f8]
call fcn.1401cca10
test eax, eax
je 0x14000bc82
inc r15d
add rbx, 8
cmp r15d, dword [rbp + 0x1498]
jge 0x14000bc89
jmp 0x14000bbe0
mov dword [rdi + 0x50], 1
mov rcx, qword [rdi + 0x38]
lea rdx, str..log
xor r8d, r8d
call fcn.140003518
mov rcx, rax
xor edx, edx
call fcn.140096794
mov qword [0x1402c3718], rax
call fcn.14008ca60
mov rcx, qword [rdi]
lea rdx, [0x1400082e0]
mov r8, rdi
call fcn.14008ea98
mov rcx, qword [r14]
lea r8, [0x140253e34]
or rdx, 0xffffffffffffffff
call fcn.1400964fc
test eax, eax
jle 0x14000bd3a
mov r8, qword [r14]
lea r12, [0x1402c8c20]
movsxd rbx, eax
mov r15d, 0x10000
mov r9, rbx
mov edx, r15d
mov rcx, r12
call fcn.1401c8008
cmp rbx, r15
jae 0x14000c396
mov byte [rbx + r12], r13b
or r9d, 0xffffffff
lea rbx, [0x1402c4c20]
mov dword [rsp + 0x28], 0x1000
mov r8, r12
mov qword [rsp + 0x20], rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rax, [rbp + 0x1498]
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], r14
cmp qword [rdi + 0x20], r13
jne 0x14000c321
cmp dword [rbp + 0x1498], 2
jl 0x14000bdbb
mov rcx, qword [r14 + 8]
lea r8, [0x140255f9c]
mov r9d, 3
mov dword [rsp + 0x20], 1
or rdx, 0xffffffffffffffff
call fcn.1400963b8
test eax, eax
jne 0x14000c321
cmp dword [rbp + 0x1498], 2
jl 0x14000bdbb
mov rcx, qword [r14 + 8]
lea r9d, [rax + 4]
lea r8, str..zip
mov dword [rsp + 0x20], 1
or rdx, 0xffffffffffffffff
call fcn.1400963b8
test eax, eax
jne 0x14000c321
mov rcx, qword [rdi]
lea r9, [rbp - 0x20]
xor r8d, r8d
lea rdx, [0x14000ba14]
call fcn.14008eb84
mov rcx, qword [rdi]
call fcn.140091abc
mov qword [rdi], r13
cmp qword [rdi + 0x48], r13
je 0x14000c0c5
cmp dword [rdi + 0x9d8], r13d
je 0x14000c0b8
cmp dword [rdi + 0xbb0], r13d
jne 0x14000bf99
call fcn.1400818c4
mov rbx, qword [rdi + 0x48]
mov rcx, rax
mov r14, rax
call fcn.14001cf64
mov r8, r14
lea rdx, [0x1400876ac]
mov rcx, rbx
call fcn.1400994cc
or edx, 0xffffffff
mov rcx, r14
call fcn.14001b5f4
test rax, rax
je 0x14000bf7b
or edx, 0xffffffff
mov rcx, r14
call fcn.140019704
lea r8, [rsp + 0x50]
or edx, 0xffffffff
mov rcx, r14
call fcn.14001b1b0
mov rbx, qword [rsp + 0x50]
mov r12, rax
movabs rax, 0xaaaaaaaaaaaaaaab
lea rcx, [rbx*4 + 4]
mul rcx
mov ecx, 0xfffffffa
lea r15, [rbx + 1]
mov rsi, rdx
shr rsi, 1
sub rcx, rsi
cmp r15, rcx
jae 0x14000bed9
mov eax, 0xfffffffe
lea rdx, [rsi + 5]
sub rax, rbx
cmp rdx, rax
jae 0x14000bed9
lea rax, [rbx + 6]
mov ecx, 0xffffffe7
add rax, rsi
cmp rax, rcx
jae 0x14000bed9
test rdx, rdx
je 0x14000bebc
lea rax, [rbx + 0x1e]
add rax, rsi
cmp rax, rcx
jae 0x14000bed9
cmp r13, rdx
lea rcx, [rbx + 0x1e]
sbb rax, rax
and eax, 0x18
add rax, rsi
add rcx, rax
call fcn.1401cd1cc
mov rcx, rax
jmp 0x14000bedc
mov rcx, r13
lea eax, [rsi + 5]
xor r9d, r9d
movsxd r8, eax
lea eax, [rbx + 1]
movsxd rdx, eax
call fcn.14008e668
mov rsi, rax
cmp qword [rax - 0x10], r13
jbe 0x14000bf03
add rax, 0x18
add rax, qword [rsi - 0x18]
jmp 0x14000bf06
mov rax, r13
mov r9, rbx
mov qword [rsp + 0x50], rax
mov r8, r12
mov rdx, r15
mov rcx, rsi
call section..text
mov rcx, r14
call fcn.140060114
mov rcx, rsi
cmp rbx, 0x7fffffff
jbe 0x14000bf4e
call fcn.14008e748
mov rsi, r13
cmp dword [rdi + 0x9e4], r13d
je 0x14000c0b8
lea rcx, str._Service_Parameters___ERROR
jmp 0x14000bf8f
lea r8, [rsp + 0x50]
mov edx, ebx
call fcn.140094aa8
cmp dword [rdi + 0x9e4], r13d
je 0x14000c0b8
mov rdx, rsi
lea rcx, str._Service_Parameters____s
call fcn.1400972b4
jmp 0x14000c0b8
cmp dword [rdi + 0x9e4], r13d
je 0x14000c0b8
lea rcx, str._Service_Parameters___NONE
call fcn.1400972b4
jmp 0x14000c0b8
mov rbx, qword [rdi + 0xbc8]
lea rdx, str.Mesh_Agent
mov rcx, rbx
call fcn.1401d9f70
test eax, eax
je 0x14000c0b8
mov r9, qword [rbx - 0x18]
movabs rsi, 0xaaaaaaaaaaaaaaab
mov rax, rsi
lea r8, [r9 + 0x1e]
lea rcx, [r8*4]
mul rcx
mov ecx, 0xfffffffa
shr rdx, 1
sub rcx, rdx
cmp r8, rcx
jae 0x14000c03f
mov eax, 0xffffffe1
lea r8, [rdx + 5]
sub rax, r9
cmp r8, rax
jae 0x14000c03f
lea rax, [r9 + 0x23]
mov ecx, 0xffffffe7
add rax, rdx
cmp rax, rcx
jae 0x14000c03f
test r8, r8
je 0x14000c01a
lea rax, [r9 + 0x3b]
add rax, rdx
cmp rax, rcx
jae 0x14000c03f
mov ecx, gethostname
test r8, r8
lea eax, [rcx + 0x18]
cmovne ecx, eax
add rcx, r8
add rcx, r9
call fcn.1401cd1cc
mov rbx, qword [rdi + 0xbc8]
mov r10, rax
jmp 0x14000c042
mov r10, r13
mov rax, qword [rbx - 0x18]
xor r9d, r9d
lea rcx, [rax*4 + 0x78]
mov rax, rsi
mul rcx
mov rcx, r10
shr rdx, 1
add rdx, 5
movsxd r8, edx
movsxd rdx, dword [rbx - 0x18]
add rdx, 0x1e
call fcn.14008e668
mov rsi, rax
cmp qword [rax - 0x10], r13
jbe 0x14000c087
mov rdx, qword [rax - 0x18]
add rax, 0x18
add rax, rdx
jmp 0x14000c08e
mov rdx, qword [rsi - 0x18]
mov rax, r13
mov r9, qword [rdi + 0xbc8]
lea r8, str.____meshServiceName__s___
mov rcx, rsi
mov qword [rsp + 0x50], rax
call fcn.140001148
mov edx, eax
lea r8, [rsp + 0x50]
mov rcx, rsi
call fcn.140094aa8
mov rcx, qword [rdi + 0x48]
call fcn.140099ffc
mov qword [rdi + 0x48], r13
cmp dword [rdi + 0x9d8], r13d
je 0x14000c312
xor edx, edx
mov dword [rsp + 0x70], WSAGetLastError
lea rcx, [rsp + 0x78]
lea r8d, [rdx + 0x60]
call fcn.1401c31c0
mov rcx, qword [rdi + 0x38]
lea rdx, str..update.exe
xor r8d, r8d
call fcn.140003518
mov r14, rax
cmp dword [rdi + 0x9e4], r13d
je 0x14000c122
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.SelfUpdate____Updating...
xor edx, edx
call fcn.14009718c
cmp dword [rdi + 0xbb8], r13d
jne 0x14000c154
mov rax, qword [rdi + 0x38]
lea rbx, [0x1402c7c20]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r9, r14
lea r8, str._s__update:__s_
mov edx, 0x1000
call fcn.140001148
jmp 0x14000c1b6
test rsi, rsi
jne 0x14000c162
lea rcx, str.W10
jmp 0x14000c175
cmp qword [rsi - 0x10], r13
jbe 0x14000c172
lea rcx, [rsi + 0x18]
add rcx, qword [rsi - 0x18]
jmp 0x14000c175
mov rcx, r13
cmp dword [rdi + 0xbb0], r13d
lea rdx, [0x140256308]
mov qword [rsp + 0x28], rcx
lea rax, [0x14025630c]
cmovne rax, rdx
lea rbx, [0x1402c7c20]
mov edx, 0x1000
mov qword [rsp + 0x20], rax
mov r9, r14
lea r8, str._s__update:_s__s
mov rcx, rbx
call fcn.140001148
cmp dword [rdi + 0x9e4], r13d
je 0x14000c1d4
mov edx, dword [rdi + 0xbb8]
lea rcx, str.SelfUpdate__d_____CreateProcessW___with_parameters:__s
mov r8, rbx
call fcn.1400972b4
lea r12, [0x1402c4c20]
mov dword [rsp + 0x28], 0x1000
or r9d, 0xffffffff
mov qword [rsp + 0x20], r12
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x58]
mov r15d, 0x8000000
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rdx, r12
mov qword [rsp + 0x38], r13
xor ecx, ecx
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000c2fc
cmp dword [rdi + 0x9e4], r13d
je 0x14000c268
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.SelfUpdate____FAILED...
xor edx, edx
call fcn.14009718c
test r14, r14
je 0x14000c312
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x14000c312
jmp 0x14000c28f
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rdi + 0x38]
mov rdx, r14
call fcn.14008c9bc
test eax, eax
je 0x14000c280
mov dword [rsp + 0x28], 0x1000
or r9d, 0xffffffff
mov r8, rbx
mov qword [rsp + 0x20], r12
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
mov rdx, r12
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000c312
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x14000c342
mov rcx, rsi
call fcn.14008e748
jmp 0x14000c342
mov rcx, qword [rdi]
lea r9, [rbp - 0x20]
xor r8d, r8d
lea rdx, [0x14000ba00]
call fcn.14008eb84
mov rcx, qword [rdi]
call fcn.140091abc
mov qword [rdi], r13
mov eax, dword [0x1402c3708]
dec eax
mov dword [0x1402c3708], eax
test eax, eax
jg 0x14000c359
call fcn.1400cb5c0
mov rcx, qword [0x1402c3718]
test rcx, rcx
je 0x14000c36a
call fcn.1401ccb68
xor eax, eax
mov rcx, qword [rbp + 0x1440]
xor rcx, rsp
call fcn.1401c0ed0
mov rbx, qword [rsp + 0x1590]
add rsp, 0x1550
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1401c0ffc
int3