Function at 0x14000fd50
Capabilities:
Delete registry key
Set environment variable
Set registry value
Terminate process

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x5d8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x162
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x5f8]
mov rax, qword [0x140575740]
xor rax, rbp
mov qword [rbp + 0x578], rax
mov qword [rbp + 0x4a8], 0
mov dword [rbp], 0
lea rdx, str.__DUMMY__
lea rcx, [0x1404da9bc]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
nop
mov dword [rbp + 8], 0
jmp 0x14000fdd3
mov eax, dword [rbp + 8]
inc eax
mov dword [rbp + 8], eax
mov eax, dword [rbp + 0x5a8]
cmp dword [rbp + 8], eax
jge 0x14000fe73
movsxd rax, dword [rbp + 8]
lea rdx, str._recovery
mov rcx, qword [rbp + 0x5b0]
mov rcx, qword [rcx + rax*8]
call fcn.14038a9d0
test eax, eax
jne 0x14000fe28
mov rax, qword [rbp + 0x5a0]
mov eax, dword [rax + 0x298]
or eax, 0x40
mov rcx, qword [rbp + 0x5a0]
mov dword [rcx + 0x298], eax
mov dword [rbp + 0x5b8], 0
movsxd rax, dword [rbp + 8]
lea rdx, str._nocertstore
mov rcx, qword [rbp + 0x5b0]
mov rcx, qword [rcx + rax*8]
call fcn.14038a9d0
test eax, eax
jne 0x14000fe6e
mov dword [rbp + 0x5b8], 0
lea rcx, str._Not_using_Certificate_Store__n
call fcn.140015e70
mov rax, qword [rbp + 0x5a0]
mov dword [rax + 0xc70], 1
jmp 0x14000fdcb
mov dword [rbp + 8], 0
jmp 0x14000fe84
mov eax, dword [rbp + 8]
inc eax
mov dword [rbp + 8], eax
mov eax, dword [rbp + 0x5a8]
cmp dword [rbp + 8], eax
jge 0x14000ff6f
movsxd rax, dword [rbp + 8]
mov rcx, qword [rbp + 0x5b0]
mov rdx, qword [rcx + rax*8]
lea rcx, [0x1404daa08]
call fcn.14038a9d0
test eax, eax
je 0x14000ff51
movsxd rax, dword [rbp + 8]
mov rcx, qword [rbp + 0x5b0]
mov rdx, qword [rcx + rax*8]
lea rcx, [0x1404daa18]
call fcn.14038a9d0
test eax, eax
je 0x14000ff51
movsxd rax, dword [rbp + 8]
mov rcx, qword [rbp + 0x5b0]
mov rdx, qword [rcx + rax*8]
lea rcx, [0x1404daa28]
call fcn.14038a9d0
test eax, eax
je 0x14000ff51
movsxd rax, dword [rbp + 8]
mov rcx, qword [rbp + 0x5b0]
mov rdx, qword [rcx + rax*8]
lea rcx, [0x1404daa38]
call fcn.14038a9d0
test eax, eax
je 0x14000ff51
movsxd rax, dword [rbp + 8]
mov rcx, qword [rbp + 0x5b0]
mov rdx, qword [rcx + rax*8]
lea rcx, [0x1404daa48]
call fcn.14038a9d0
test eax, eax
je 0x14000ff51
movsxd rax, dword [rbp + 8]
mov rcx, qword [rbp + 0x5b0]
mov rdx, qword [rcx + rax*8]
lea rcx, [0x1404daa58]
call fcn.14038a9d0
test eax, eax
jne 0x14000ff6a
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14015b2a0
mov rcx, qword [rbp + 0x5a0]
mov qword [rcx + 0x48], rax
jmp 0x14000ff6f
jmp 0x14000fe7c
mov rax, qword [rbp + 0x5a0]
cmp qword [rax + 0x48], 0
jne 0x14000ffaf
xor r8d, r8d
lea rdx, [0x1404daa64]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x38]
call fcn.140002670
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.14015b2a0
mov rcx, qword [rbp + 0x5a0]
mov qword [rcx + 0x48], rax
mov dword [rbp + 0xc], 0
mov dword [rbp + 0x10], 0
mov dword [rbp + 0x14], 0
mov dword [rbp + 0x18], 0
mov dword [rbp + 8], 0
jmp 0x14000ffdc
mov eax, dword [rbp + 8]
inc eax
mov dword [rbp + 8], eax
mov eax, dword [rbp + 0x5a8]
cmp dword [rbp + 8], eax
jge 0x140010327
movsxd rax, dword [rbp + 8]
mov edx, 0x1000
mov rcx, qword [rbp + 0x5b0]
mov rcx, qword [rcx + rax*8]
call fcn.140001180
mov dword [rbp + 0x1c], eax
movsxd rax, dword [rbp + 8]
mov rcx, qword [rbp + 0x5b0]
mov rdx, qword [rcx + rax*8]
lea rcx, [0x1404daa68]
call fcn.14038a9d0
test eax, eax
jne 0x14001002d
mov dword [rbp + 0x14], 1
movsxd rax, dword [rbp + 8]
mov rcx, qword [rbp + 0x5b0]
mov rdx, qword [rcx + rax*8]
lea rcx, [0x1404daa70]
call fcn.14038a9d0
test eax, eax
je 0x14001006b
movsxd rax, dword [rbp + 8]
mov rcx, qword [rbp + 0x5b0]
mov rdx, qword [rcx + rax*8]
lea rcx, [0x1404daa80]
call fcn.14038a9d0
test eax, eax
jne 0x140010072
mov dword [rbp + 0x10], 1
movsxd rax, dword [rbp + 8]
mov rcx, qword [rbp + 0x5b0]
mov rdx, qword [rcx + rax*8]
lea rcx, [0x1404daa90]
call fcn.14038a9d0
test eax, eax
jne 0x1400100cf
mov dword [rbp + 0x10], 5
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
lea r9, [0x1404daa9c]
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str._localService
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015b5b0
nop
movsxd rax, dword [rbp + 8]
mov rcx, qword [rbp + 0x5b0]
mov rdx, qword [rcx + rax*8]
lea rcx, [0x1404daab0]
call fcn.14038a9d0
test eax, eax
je 0x14001010d
movsxd rax, dword [rbp + 8]
mov rcx, qword [rbp + 0x5b0]
mov rdx, qword [rcx + rax*8]
lea rcx, [0x1404daac0]
call fcn.14038a9d0
test eax, eax
jne 0x14001014b
mov dword [rbp + 0x10], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
lea r9, [0x1404daad0]
mov r8d, ntohs
lea rdx, str._deleteData
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015b5b0
nop
movsxd rax, dword [rbp + 8]
mov rcx, qword [rbp + 0x5b0]
mov rdx, qword [rcx + rax*8]
lea rcx, [0x1404daae8]
call fcn.14038a9d0
test eax, eax
jne 0x140010171
mov dword [rbp + 0x10], 2
movsxd rax, dword [rbp + 0x1c]
movsxd rcx, dword [rbp + 8]
mov r9d, 1
lea r8, [0x1404daaf4]
mov rdx, rax
mov rax, qword [rbp + 0x5b0]
mov rcx, qword [rax + rcx*8]
call fcn.140145290
mov dword [rbp + 0x20], eax
cmp dword [rbp + 0x20], 2
jle 0x140010322
movsxd rax, dword [rbp + 8]
mov r8d, 2
lea rdx, [0x1404daaf8]
mov rcx, qword [rbp + 0x5b0]
mov rcx, qword [rcx + rax*8]
call fcn.14038b1b0
test eax, eax
jne 0x140010322
mov eax, dword [rbp + 0x20]
sub eax, 2
cmp eax, 8
jne 0x14001027e
movsxd rax, dword [rbp + 8]
mov rcx, qword [rbp + 0x5b0]
mov rax, qword [rcx + rax*8]
add rax, 2
mov r8d, 8
lea rdx, str.readonly
mov rcx, rax
call fcn.14038b1b0
test eax, eax
jne 0x14001027e
movsxd rax, dword [rbp + 8]
movsxd rcx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x5b0]
mov rax, qword [rdx + rax*8]
lea rax, [rax + rcx + 1]
mov r8d, 1
lea rdx, [0x1404dab0c]
mov rcx, rax
call fcn.14038b1b0
test eax, eax
jne 0x14001027e
mov dword [rbp + 0x18], 1
mov rax, qword [rbp + 0x5a0]
cmp qword [rax + 0x48], 0
je 0x14001027e
xor r8d, r8d
lea rdx, [0x1404dab10]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x38]
call fcn.140002670
mov rdx, rax
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015b3a0
nop
mov rax, qword [rbp + 0x5a0]
cmp qword [rax + 0x48], 0
jne 0x1400102a3
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14015b2a0
mov rcx, qword [rbp + 0x5a0]
mov qword [rcx + 0x48], rax
mov eax, dword [rbp + 0x20]
inc eax
mov ecx, dword [rbp + 0x1c]
sub ecx, eax
mov eax, ecx
cdqe
movsxd rcx, dword [rbp + 8]
movsxd rdx, dword [rbp + 0x20]
mov r8, qword [rbp + 0x5b0]
mov rcx, qword [r8 + rcx*8]
lea rcx, [rcx + rdx + 1]
mov edx, dword [rbp + 0x20]
sub edx, 2
movsxd rdx, edx
movsxd r8, dword [rbp + 8]
mov r9, qword [rbp + 0x5b0]
mov r8, qword [r9 + r8*8]
add r8, 2
mov qword [rbp + 0x4b8], r8
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov r9, rcx
mov r8, rdx
mov rax, qword [rbp + 0x4b8]
mov rdx, rax
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015b5b0
mov eax, dword [rbp + 0xc]
inc eax
mov dword [rbp + 0xc], eax
jmp 0x14000ffd4
mov eax, dword [rbp + 0xc]
mov ecx, dword [rbp + 0x5a8]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0x5a8], eax
mov rax, qword [rbp + 0x5a0]
cmp qword [rax + 0x48], 0
jne 0x14001035f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14015b2a0
mov rcx, qword [rbp + 0x5a0]
mov qword [rcx + 0x48], rax
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015b440
test eax, eax
je 0x1400103b2
mov edx, 0x400
lea rcx, [0x1404dab18]
call fcn.140001180
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.readmsh
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
test eax, eax
je 0x140010476
xor r8d, r8d
lea rdx, str..mshx
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x38]
call fcn.140002670
mov rdx, rax
mov rcx, qword [rbp + 0x5a0]
call fcn.14000f610
test eax, eax
jne 0x140010476
xor r8d, r8d
lea rdx, [0x1404dab30]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x38]
call fcn.140002670
mov rdx, rax
mov rcx, qword [rbp + 0x5a0]
call fcn.14000f610
test eax, eax
jne 0x140010476
lea rdx, str.mesh_linumshx
mov rcx, qword [rbp + 0x5a0]
call fcn.14000f610
test eax, eax
jne 0x140010476
lea rdx, str.mesh_limshx
mov rcx, qword [rbp + 0x5a0]
call fcn.14000f610
test eax, eax
jne 0x140010476
xor edx, edx
mov rcx, qword [rbp + 0x5a0]
call fcn.14000f280
xor r8d, r8d
lea rdx, [0x1404dab54]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x38]
call fcn.140002670
mov rdx, rax
mov rcx, qword [rbp + 0x5a0]
call fcn.14000f610
nop
mov edx, 0x400
lea rcx, [0x1404dab60]
call fcn.140001180
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x1404dab70]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
test eax, eax
je 0x140010530
mov edx, 0x400
lea rcx, [0x1404dab80]
call fcn.140001180
mov qword [rsp + 0x20], 0x1000
lea r9, [0x14058a640]
mov r8, rax
lea rdx, str.maxLogSize
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0x1000
jae 0x140010530
mov qword [rbp + 0x38], 0
movsxd rax, dword [rbp + 0x24]
mov r9, 0xffffffffffffffff
mov r8, rax
lea rdx, [0x14058a640]
lea rcx, [rbp + 0x38]
call fcn.140136d10
test eax, eax
jne 0x140010530
mov rax, qword [rbp + 0x38]
mov qword [0x140558e80], rax
mov rax, qword [rbp + 0x5a0]
cmp dword [rax + 0xc70], 0
jne 0x140010584
mov edx, 0x400
lea rcx, [0x1404daba0]
call fcn.140001180
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.nocertstore
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov rcx, qword [rbp + 0x5a0]
mov dword [rcx + 0xc70], eax
cmp dword [rbp + 0x14], 0
je 0x14001061c
call fcn.140117cd0
mov rcx, qword [rbp + 0x5a0]
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
lea rcx, [0x140013620]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov rcx, qword [rbp + 0x5a0]
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x5a0]
mov r9, qword [rcx]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140117de0
mov qword [rbp + 0x48], rax
mov r9d, 0xe08
xor r8d, r8d
lea rdx, str.require__agentStatus_.start___
mov rcx, qword [rbp + 0x48]
call fcn.14003f390
mov eax, 1
jmp 0x1400132e4
cmp dword [rbp + 0x10], 0
je 0x1400108bd
call fcn.140117cd0
mov rcx, qword [rbp + 0x5a0]
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
lea rcx, [0x140013620]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov rcx, qword [rbp + 0x5a0]
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x5a0]
mov r9, qword [rcx]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140117de0
mov qword [rbp + 0x50], rax
mov r8, qword [rbp + 0x5a0]
mov rax, qword [rbp + 0x5a0]
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x50]
call fcn.14000b670
mov r9d, 0xe08
xor r8d, r8d
lea rdx, [0x1404dabe8]
mov rcx, qword [rbp + 0x50]
call fcn.14003f390
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x50]
call fcn.140037d70
test eax, eax
jne 0x1400106ec
lea rcx, str.___Administrator_permissions_needed..._n
call fcn.140015e70
mov dword [rbp + 0x10], 0
xor ecx, ecx
call fcn.14038e600
nop
mov eax, dword [rbp + 0x10]
mov dword [rbp + 0x4c0], eax
cmp dword [rbp + 0x4c0], 1
je 0x140010719
cmp dword [rbp + 0x4c0], 2
je 0x1400107e6
cmp dword [rbp + 0x4c0], 5
je 0x140010719
jmp 0x1400108ae
mov r9d, 0xe08
xor r8d, r8d
lea rdx, [0x1404dac38]
mov rcx, qword [rbp + 0x50]
call fcn.14003f390
lea r8, str.fullInstall
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x50]
call fcn.14003bf90
mov edx, 0xfffffffe
mov rcx, qword [rbp + 0x50]
call fcn.140033b00
mov rax, qword [rbp + 0x5a0]
mov rdx, qword [rax + 0x48]
mov rcx, qword [rbp + 0x50]
call fcn.140124b20
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x50]
call fcn.14003b980
mov edx, 1
mov rcx, qword [rbp + 0x50]
call fcn.14003f030
test eax, eax
je 0x1400107ce
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x50]
call fcn.14003ab50
lea rdx, [0x1404dac68]
mov rcx, rax
call fcn.14038a9d0
test eax, eax
je 0x1400107ce
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x50]
call fcn.14003ab50
mov rdx, rax
lea rcx, [0x1404dac94]
call fcn.140015e70
nop
mov rcx, qword [rbp + 0x50]
call fcn.140036e50
mov eax, 1
jmp 0x1400132e4
mov r9d, 0xe08
xor r8d, r8d
lea rdx, str.require_agent_installer__
mov rcx, qword [rbp + 0x50]
call fcn.14003f390
lea r8, str.fullUninstall
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x50]
call fcn.14003bf90
mov edx, 0xfffffffe
mov rcx, qword [rbp + 0x50]
call fcn.140033b00
mov rax, qword [rbp + 0x5a0]
mov rdx, qword [rax + 0x48]
mov rcx, qword [rbp + 0x50]
call fcn.140124b20
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x50]
call fcn.14003b980
mov edx, 1
mov rcx, qword [rbp + 0x50]
call fcn.14003f030
test eax, eax
je 0x14001089b
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x50]
call fcn.14003ab50
lea rdx, [0x1404dacc8]
mov rcx, rax
call fcn.14038a9d0
test eax, eax
je 0x14001089b
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x50]
call fcn.14003ab50
mov rdx, rax
lea rcx, [0x1404dacf4]
call fcn.140015e70
nop
mov rcx, qword [rbp + 0x50]
call fcn.140036e50
mov eax, 1
jmp 0x1400132e4
mov rcx, qword [rbp + 0x50]
call fcn.1400e0900
nop
jmp 0x140010a72
mov rax, qword [rbp + 0x5a0]
cmp qword [rax + 0x48], 0
je 0x1400108ed
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015b440
test eax, eax
je 0x140010a72
cmp dword [rbp + 0x18], 0
jne 0x140010a72
mov r9d, 0x136a
lea r8, [0x1404dacf8]
mov edx, 1
mov ecx, gethostname
call fcn.1403ba980
xor r9d, r9d
xor r8d, r8d
mov edx, 0x20
mov rcx, rax
call fcn.1401375b0
mov qword [rbp + 0x58], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x58]
mov rdx, qword [rbp + 0x5a0]
mov qword [rcx + rax], rdx
movsxd rax, dword [rbp + 0x5a8]
mov ecx, 8
imul rcx, rcx, 1
mov rdx, qword [rbp + 0x58]
mov qword [rdx + rcx], rax
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rbp + 0x58]
mov rdx, qword [rbp + 0x5b0]
mov qword [rcx + rax], rdx
movsxd rax, dword [rbp + 0x5b8]
mov ecx, 8
imul rcx, rcx, 3
mov rdx, qword [rbp + 0x58]
mov qword [rdx + rcx], rax
mov rax, qword [rbp + 0x5a0]
cmp qword [rax + 0x48], 0
je 0x1400109ad
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015b4f0
mov rax, qword [rbp + 0x5a0]
mov qword [rax + 0x48], 0
mov rax, qword [rbp + 0x5a0]
mov eax, dword [rax + 0xdb8]
mov dword [rbp + 0x4c4], eax
cmp dword [rbp + 0x4c4], 0xa
je 0x1400109cb
jmp 0x1400109de
lea rcx, str.Unable_to_open_database._r_n
call fcn.140015e70
xor eax, eax
jmp 0x1400132e4
mov rax, qword [rbp + 0x5a0]
mov eax, dword [rax + 0xdb8]
inc eax
mov edx, eax
lea rcx, str.Unable_to_open_database___d_10_..._r_n
call fcn.140015e70
mov rax, qword [rbp + 0x5a0]
mov eax, dword [rax + 0xdb8]
inc eax
mov rcx, qword [rbp + 0x5a0]
mov dword [rcx + 0xdb8], eax
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax]
call fcn.14013c870
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x137e
lea rcx, [0x1404dad80]
mov qword [rsp + 0x28], rcx
lea rcx, [0x140013320]
mov qword [rsp + 0x20], rcx
lea r9, [0x140013350]
mov r8d, 0x7d0
mov rdx, qword [rbp + 0x58]
mov rcx, rax
call fcn.140143da0
mov eax, 1
jmp 0x1400132e4
mov rax, qword [rbp + 0x5a0]
mov rdx, qword [rax]
mov ecx, 3
call fcn.14015f300
mov rcx, qword [rbp + 0x5a0]
mov qword [rcx + 0x40], rax
mov rax, qword [rbp + 0x5a0]
cmp qword [rax + 0x48], 0
je 0x140010bdd
mov r8, qword [rbp + 0x5a0]
lea rdx, [0x140013690]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015bbe0
mov edx, 0x400
lea rcx, [0x1404dadc0]
call fcn.140001180
mov qword [rsp + 0x20], 0x1000
lea r9, [0x14058a640]
mov r8, rax
lea rdx, str.enableILibRemoteLogging
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov dword [rbp + 0x60], eax
cmp dword [rbp + 0x60], 0
je 0x140010b8a
movsxd rax, dword [rbp + 0x60]
mov qword [rbp + 0x490], rax
cmp qword [rbp + 0x490], 0x1000
jae 0x140010b23
jmp 0x140010b29
call fcn.14037c0a0
nop
lea rax, [0x14058a640]
mov rcx, qword [rbp + 0x490]
mov byte [rax + rcx], 0
xor r8d, r8d
lea rdx, [0x1404dadf0]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x38]
call fcn.140002670
mov qword [rbp + 0x4c8], rax
mov edx, 0x1000
lea rcx, [0x14058a640]
call fcn.140136fb0
mov rcx, qword [rbp + 0x4c8]
mov r8, rcx
movzx edx, ax
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax]
call fcn.1401383a0
nop
mov edx, 0x400
lea rcx, [0x1404dadf8]
call fcn.140001180
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.semaphoreTrack
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
test eax, eax
je 0x140010bdd
mov dword [0x140576560], 0
lea rax, [0x140013770]
mov qword [0x1405772f0], rax
mov rax, qword [rbp + 0x5a0]
cmp qword [rax], 0
je 0x140010c13
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rbp + 0x5a0]
add rax, qword [rcx]
mov ecx, 8
imul rcx, rcx, 0
mov rax, qword [rax + rcx]
mov qword [rbp + 0x4d0], rax
jmp 0x140010c1e
mov qword [rbp + 0x4d0], 0
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x5b0]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x20], rax
lea r9, str.agentcore:_argv_0____s
mov r8d, 2
mov edx, 0x100
mov rcx, qword [rbp + 0x4d0]
call fcn.1401589b0
call fcn.140117cd0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov rcx, qword [rbp + 0x5a0]
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x5a0]
mov r9, qword [rcx]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140117de0
mov qword [rbp + 0x68], rax
mov r9d, 0xf88
xor r8d, r8d
lea rdx, str.require_linux_pathfix____
mov rcx, qword [rbp + 0x68]
call fcn.14003f390
mov rax, qword [rbp + 0x5a0]
mov dword [rax + 0xdbc], 0
mov rax, qword [rbp + 0x5a0]
mov dword [rax + 0xdc0], 0
mov rax, qword [rbp + 0x5a0]
mov dword [rax + 0xdc4], 0
mov edx, 0x400
lea rcx, [0x1404dae50]
call fcn.140001180
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x1404dae60]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov dword [rbp + 0x70], eax
cmp dword [rbp + 0x70], 0
je 0x140010e38
mov eax, dword [rbp + 0x70]
inc eax
cdqe
mov ecx, 0xffffffff
cmp rax, rcx
jae 0x140010db0
mov eax, dword [rbp + 0x70]
inc eax
cdqe
mov ecx, 0xffffffff
sub rcx, rax
mov rax, rcx
test rax, rax
jbe 0x140010db0
mov eax, dword [rbp + 0x70]
inc eax
cdqe
mov ecx, 0xffffffe7
cmp rax, rcx
jae 0x140010db0
xor eax, eax
cmp eax, 1
je 0x140010db0
mov eax, dword [rbp + 0x70]
inc eax
cdqe
add rax, 0x18
mov r9d, 0x13b5
lea r8, [0x1404dae70]
mov edx, 1
mov rcx, rax
call fcn.1403ba980
mov qword [rbp + 0x4d8], rax
jmp 0x140010dbb
mov qword [rbp + 0x4d8], 0
mov eax, dword [rbp + 0x70]
inc eax
cdqe
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x4d8]
call fcn.1401375b0
mov rcx, qword [rbp + 0x5a0]
mov qword [rcx + 0xdd8], rax
movsxd rax, dword [rbp + 0x70]
mov qword [rbp + 0x4e0], rax
mov edx, 0x400
lea rcx, [0x1404daeb0]
call fcn.140001180
mov rcx, qword [rbp + 0x4e0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x5a0]
mov r9, qword [rcx + 0xdd8]
mov r8, rax
lea rdx, [0x1404daec0]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
nop
jmp 0x140010e4d
mov rax, qword [rbp + 0x5a0]
lea rcx, [0x1404daed0]
mov qword [rax + 0xdd8], rcx
mov edx, 0x400
lea rcx, [0x1404daee0]
call fcn.140001180
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x1404daef0]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov dword [rbp + 0x70], eax
cmp dword [rbp + 0x70], 0
je 0x140010f87
mov eax, dword [rbp + 0x70]
inc eax
cdqe
mov ecx, 0xffffffff
cmp rax, rcx
jae 0x140010eff
mov eax, dword [rbp + 0x70]
inc eax
cdqe
mov ecx, 0xffffffff
sub rcx, rax
mov rax, rcx
test rax, rax
jbe 0x140010eff
mov eax, dword [rbp + 0x70]
inc eax
cdqe
mov ecx, 0xffffffe7
cmp rax, rcx
jae 0x140010eff
xor eax, eax
cmp eax, 1
je 0x140010eff
mov eax, dword [rbp + 0x70]
inc eax
cdqe
add rax, 0x18
mov r9d, 0x13c3
lea r8, [0x1404daf00]
mov edx, 1
mov rcx, rax
call fcn.1403ba980
mov qword [rbp + 0x4e8], rax
jmp 0x140010f0a
mov qword [rbp + 0x4e8], 0
mov eax, dword [rbp + 0x70]
inc eax
cdqe
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x4e8]
call fcn.1401375b0
mov rcx, qword [rbp + 0x5a0]
mov qword [rcx + 0xde0], rax
movsxd rax, dword [rbp + 0x70]
mov qword [rbp + 0x4f0], rax
mov edx, 0x400
lea rcx, [0x1404daf40]
call fcn.140001180
mov rcx, qword [rbp + 0x4f0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x5a0]
mov r9, qword [rcx + 0xde0]
mov r8, rax
lea rdx, [0x1404daf50]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
nop
jmp 0x140010f9c
mov rax, qword [rbp + 0x5a0]
lea rcx, str.MeshCentral
mov qword [rax + 0xde0], rcx
mov rax, qword [rbp + 0x5a0]
mov r8, qword [rax + 0xdd8]
lea rdx, str.require_service_manager_.manager.getService__s_.isMe___
mov rcx, qword [rbp + 0x68]
call fcn.140035330
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x68]
call fcn.140037eb0
mov qword [rbp + 0x78], rax
mov r9d, 0xe88
xor r8d, r8d
lea rdx, str._function_foo____var_f__require_service_manager_.manager.getServiceType____switch_f_case_procd:_return_7___case_windows:_return_10___case_launchd:_return_3___case_freebsd:_return_5___case_systemd:_return_1___case_init:_return_2___case_upstart:_return_4___default:_return_0_____
mov rcx, qword [rbp + 0x68]
call fcn.14003f390
test eax, eax
jne 0x140011004
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x68]
call fcn.140037e10
mov rcx, qword [rbp + 0x5a0]
mov dword [rcx + 0xdbc], eax
mov r9d, 0xe88
xor r8d, r8d
mov rdx, qword [rbp + 0x78]
mov rcx, qword [rbp + 0x68]
call fcn.14003f390
test eax, eax
jne 0x140011039
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x68]
call fcn.140037d70
mov rcx, qword [rbp + 0x5a0]
mov dword [rcx + 0xdc0], eax
mov r9d, 0xe88
xor r8d, r8d
lea rdx, str.require_user_sessions_.isRoot___
mov rcx, qword [rbp + 0x68]
call fcn.14003f390
test eax, eax
jne 0x140011071
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x68]
call fcn.140037d70
mov rcx, qword [rbp + 0x5a0]
mov dword [rcx + 0xdc4], eax
mov rax, qword [rbp + 0x5a0]
cmp dword [rax + 0xdc0], 0
jne 0x140011235
mov rax, qword [rbp + 0x5a0]
cmp dword [rax + 0xde8], 0
je 0x140011235
mov r9d, 0xe88
xor r8d, r8d
lea rdx, str.require_util_service_check___
mov rcx, qword [rbp + 0x68]
call fcn.14003f390
test eax, eax
jne 0x140011235
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x68]
call fcn.140037120
and eax, 6
test eax, eax
je 0x1400110db
mov dword [rbp + 0x4f8], 1
jmp 0x1400110e5
mov dword [rbp + 0x4f8], 0
cmp dword [rbp + 0x4f8], 0
jne 0x140011235
lea r8, [rbp + 0x88]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x68]
call fcn.14003ab50
mov qword [rbp + 0x98], rax
mov r8, qword [rbp + 0x98]
mov rax, qword [rbp + 0x5a0]
mov rdx, qword [rax + 0xdd8]
lea rcx, str.Service_Name_Conflict:_Configured___s__but_is_actually___s_
call fcn.14014d820
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0xdd8]
call fcn.140137da0
mov rax, qword [rbp + 0x88]
inc rax
mov ecx, 0xffffffff
cmp rax, rcx
jae 0x1400111b9
mov rax, qword [rbp + 0x88]
inc rax
mov ecx, 0xffffffff
sub rcx, rax
mov rax, rcx
test rax, rax
jbe 0x1400111b9
mov rax, qword [rbp + 0x88]
inc rax
mov ecx, 0xffffffe7
cmp rax, rcx
jae 0x1400111b9
xor eax, eax
cmp eax, 1
je 0x1400111b9
mov rax, qword [rbp + 0x88]
add rax, 0x19
mov r9d, 0x13ea
lea r8, [0x1404db168]
mov edx, 1
mov rcx, rax
call fcn.1403ba980
mov qword [rbp + 0x500], rax
jmp 0x1400111c4
mov qword [rbp + 0x500], 0
mov eax, dword [rbp + 0x88]
inc eax
cdqe
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x500]
call fcn.1401375b0
mov rcx, qword [rbp + 0x5a0]
mov qword [rcx + 0xdd8], rax
mov rax, qword [rbp + 0x5a0]
mov rax, qword [rax + 0xdd8]
mov r9, qword [rbp + 0x88]
mov r8, qword [rbp + 0x98]
mov rdx, qword [rax - 0x18]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0xdd8]
call fcn.140001030
mov rax, qword [rbp + 0x5a0]
mov dword [rax + 0xdc0], 1
mov rax, qword [rbp + 0x5a0]
mov r8, qword [rax + 0xdd8]
lea rdx, str.require__agentNodeId_.checkResetNodeId__s__
mov rcx, qword [rbp + 0x68]
call fcn.140035330
mov r9d, 0x889
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x68]
call fcn.14003f390
test eax, eax
jne 0x1400112a5
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x68]
call fcn.1400372e0
test eax, eax
je 0x1400112a3
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x68]
call fcn.140037d70
test eax, eax
je 0x1400112a3
mov dword [rbp], 1
lea rcx, str.NodeID_will_reset__because_ResetNodeId_was_set_in_the_registry
call fcn.14014d820
nop
jmp 0x1400112d1
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x68]
call fcn.14003ab50
mov qword [rbp + 0xa0], rax
mov rdx, qword [rbp + 0xa0]
lea rcx, str.Error_checking_ResetNodeId_in_registry:__s
call fcn.14014d820
nop
mov edx, 0x400
lea rcx, [0x1404db248]
call fcn.140001180
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.skipmaccheck
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
test eax, eax
jne 0x14001166a
mov r9d, 0xe88
xor r8d, r8d
lea rdx, str._function__getMac____var_ret____var_ni__require_os_.networkInterfaces____for__var_f_in_ni___for__var_i_in_ni_f____if_ni_f__i_.type__ethernet__ni_f__i_.type__wireless__ret______ni_f__i_.mac________return_ret_______
mov rcx, qword [rbp + 0x68]
call fcn.14003f390
test eax, eax
jne 0x14001166a
lea r8, [rbp + 0xb8]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x68]
call fcn.140037f10
mov qword [rbp + 0xc8], rax
cmp qword [rbp + 0xb8], 0x13
jb 0x14001166a
mov edx, 0x400
lea rcx, [0x1404db368]
call fcn.140001180
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x1404db380]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov dword [rbp + 0xa8], eax
cmp dword [rbp + 0xa8], 0
jne 0x1400113e0
movsxd rax, dword [rbp + 0xb8]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0xc8]
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, [0x1404db398]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015bc30
nop
jmp 0x14001166a
mov dword [rbp + 0xd0], 0
mov eax, dword [rbp + 0xb8]
cmp dword [rbp + 0xd0], eax
jge 0x140011438
movsxd rax, dword [rbp + 0xd0]
mov rcx, qword [rbp + 0xc8]
add rcx, rax
mov rax, rcx
mov r8d, reloc.WS2_32.dll_send
lea rdx, [0x1404db3b0]
mov rcx, rax
call fcn.14038b1b0
test eax, eax
je 0x140011427
jmp 0x140011438
mov eax, dword [rbp + 0xd0]
add eax, 0x13
mov dword [rbp + 0xd0], eax
jmp 0x1400113ea
mov eax, dword [rbp + 0xb8]
cmp dword [rbp + 0xd0], eax
jge 0x14001166a
mov dword [rbp + 0xd0], 0
mov eax, dword [rbp + 0xa8]
inc eax
cdqe
mov ecx, 0xffffffc7
cmp rax, rcx
jae 0x1400114ed
mov eax, dword [rbp + 0xa8]
inc eax
cdqe
add rax, 0x38
add rax, 0x24
mov qword [rbp + 0x508], rax
mov rax, qword [rbp + 0x508]
add rax, 0xf
cmp rax, qword [rbp + 0x508]
ja 0x1400114a3
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14037c5f0
sub rsp, rax
lea rax, [rsp + 0x50]
mov qword [rbp + 0x510], rax
lea r8, [rbp + 0x4a8]
mov rdx, qword [rbp + 0x508]
mov rcx, qword [rbp + 0x510]
call fcn.14037c2c0
add qword [rbp + 0x510], 0x20
mov rax, qword [rbp + 0x510]
mov qword [rbp + 0x518], rax
jmp 0x1400114f8
mov qword [rbp + 0x518], 0
mov eax, dword [rbp + 0xa8]
inc eax
cdqe
mov r9d, 1
mov r8d, 8
mov rdx, rax
mov rcx, qword [rbp + 0x518]
call fcn.1401375b0
mov rcx, rax
call fcn.140137fe0
mov qword [rbp + 0xd8], rax
movsxd rax, dword [rbp + 0xa8]
mov qword [rbp + 0x520], rax
mov edx, 0x400
lea rcx, [0x1404db3c8]
call fcn.140001180
mov rcx, qword [rbp + 0x520]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0xd8]
mov r8, rax
lea rdx, [0x1404db3e0]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
nop
mov eax, dword [rbp + 0xa8]
cmp dword [rbp + 0xd0], eax
jge 0x140011601
movsxd rax, dword [rbp + 0xd0]
mov rcx, qword [rbp + 0xd8]
add rcx, rax
mov rax, rcx
mov r8d, reloc.WS2_32.dll_send
lea rdx, str._00:00:00:00:00:00_
mov rcx, rax
call fcn.14038b1b0
test eax, eax
je 0x1400115ed
movsxd rax, dword [rbp + 0xd0]
mov rcx, qword [rbp + 0xd8]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rbp + 0xb8]
mov r9d, reloc.WS2_32.dll_send
mov r8, rax
mov rdx, rcx
mov rcx, qword [rbp + 0xc8]
call fcn.140145290
test eax, eax
jl 0x1400115ed
jmp 0x140011601
mov eax, dword [rbp + 0xd0]
add eax, 0x13
mov dword [rbp + 0xd0], eax
jmp 0x140011579
mov eax, dword [rbp + 0xa8]
cmp dword [rbp + 0xd0], eax
jl 0x14001166a
mov r8, qword [rbp + 0xd8]
mov rdx, qword [rbp + 0xc8]
lea rcx, str.NodeID_will_reset__MAC_Address_Mismatch:__s_____s
call fcn.14014d820
mov dword [rbp], 1
movsxd rax, dword [rbp + 0xb8]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0xc8]
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.LocalMacAddresses
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015bc30
nop
mov rcx, qword [rbp + 0x68]
call fcn.1400e0900
cmp dword [rbp], 1
je 0x140011689
mov rcx, qword [rbp + 0x5a0]
call fcn.14000c0c0
test eax, eax
je 0x1400116a8
xor edx, edx
mov rcx, qword [rbp + 0x5a0]
call fcn.14000b6f0
test eax, eax
je 0x1400116a8
lea rcx, str.Certificate_error_r_n
call fcn.140015e70
nop
mov rcx, qword [rbp + 0x5a0]
call fcn.1400073a0
test eax, eax
je 0x1400116c5
lea rcx, str.Certificate_validation_error_r_n
call fcn.140015e70
nop
mov qword [rbp + 0xe8], 0
xor r8d, r8d
lea rdx, str..tag
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x38]
call fcn.140002670
mov r8d, 0x1000
lea rdx, [rbp + 0xe8]
mov rcx, rax
call fcn.140132700
mov dword [rbp + 0xf4], eax
cmp qword [rbp + 0xe8], 0
je 0x14001175c
movsxd rax, dword [rbp + 0xf4]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0xe8]
mov r8d, 3
lea rdx, [0x1404db4a0]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015bc30
mov edx, 1
mov rcx, qword [rbp + 0xe8]
call fcn.1403ba8b0
nop
jmp 0x14001177a
mov r8d, 3
lea rdx, [0x1404db4a4]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015d270
nop
mov qword [rsp + 0x20], 0xff
lea r9, [rbp + 0x110]
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.ignoreProxyFile
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
test eax, eax
jne 0x14001186e
mov qword [rbp + 0x228], 0
xor r8d, r8d
lea rdx, str..proxy
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x38]
call fcn.140002670
mov r8d, 0x400
lea rdx, [rbp + 0x228]
mov rcx, rax
call fcn.140132700
mov dword [rbp + 0x234], eax
cmp qword [rbp + 0x228], 0
je 0x14001186e
cmp dword [rbp + 0x234], 0
jle 0x14001183e
movsxd rax, dword [rbp + 0x234]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x228]
mov r8d, 8
lea rdx, [0x1404db4c0]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015bc30
nop
jmp 0x14001185c
mov r8d, 8
lea rdx, [0x1404db4d0]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015d270
nop
mov edx, 1
mov rcx, qword [rbp + 0x228]
call fcn.1403ba8b0
nop
mov dword [rbp + 0x244], 0
mov edx, 0x400
lea rcx, [0x1404db4e0]
call fcn.140001180
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x1404db4f8]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
cmp eax, 4
jne 0x140011923
mov edx, 0x400
lea rcx, [0x1404db510]
call fcn.140001180
mov qword [rsp + 0x20], 4
lea r9, [rbp + 0x244]
mov r8, rax
lea rdx, str.AgentCapabilities
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov ecx, dword [rbp + 0x244]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbp + 0x244], eax
mov rax, qword [rbp + 0x5a0]
mov ecx, dword [rbp + 0x244]
mov eax, dword [rax + 0x298]
or eax, ecx
mov rcx, qword [rbp + 0x5a0]
mov dword [rcx + 0x298], eax
mov rax, qword [rbp + 0x5a0]
mov r9, qword [rax + 0xdd8]
lea r8, [0x1404db540]
xor edx, edx
xor ecx, ecx
call fcn.140015f00
cdqe
mov qword [rbp + 0x278], rax
mov rax, qword [rbp + 0x278]
inc rax
mov ecx, 0xffffffff
cmp rax, rcx
jae 0x1400119c1
mov rax, qword [rbp + 0x278]
inc rax
mov ecx, 0xffffffff
sub rcx, rax
mov rax, rcx
test rax, rax
jbe 0x1400119c1
mov rax, qword [rbp + 0x278]
inc rax
mov ecx, 0xffffffe7
cmp rax, rcx
jae 0x1400119c1
xor eax, eax
cmp eax, 1
je 0x1400119c1
mov rax, qword [rbp + 0x278]
add rax, 0x19
mov r9d, 0x146e
lea r8, [0x1404db558]
mov edx, 1
mov rcx, rax
call fcn.1403ba980
mov qword [rbp + 0x528], rax
jmp 0x1400119cc
mov qword [rbp + 0x528], 0
mov eax, dword [rbp + 0x278]
inc eax
cdqe
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x528]
call fcn.1401375b0
mov qword [rbp + 0x280], rax
mov rax, qword [rbp + 0x5a0]
mov r9, qword [rax + 0xdd8]
lea r8, str.SoftwareOpen_Source_s
mov rax, qword [rbp + 0x280]
mov rdx, qword [rax - 0x18]
mov rcx, qword [rbp + 0x280]
call fcn.140015f00
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, qword [rbp + 0x280]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
inc eax
cdqe
mov qword [rbp + 0x288], rax
mov rax, qword [rbp + 0x288]
add rax, rax
mov ecx, 0xffffffff
cmp rax, rcx
jae 0x140011acc
mov rax, qword [rbp + 0x288]
add rax, rax
mov ecx, 0xffffffff
sub rcx, rax
mov rax, rcx
test rax, rax
jbe 0x140011acc
mov rax, qword [rbp + 0x288]
add rax, rax
mov ecx, 0xffffffe7
cmp rax, rcx
jae 0x140011acc
xor eax, eax
cmp eax, 1
je 0x140011acc
mov rax, qword [rbp + 0x288]
lea rax, [rax + rax + 0x18]
mov r9d, 0x1471
lea r8, [0x1404db5b0]
mov edx, 1
mov rcx, rax
call fcn.1403ba980
mov qword [rbp + 0x530], rax
jmp 0x140011ad7
mov qword [rbp + 0x530], 0
movsxd rax, dword [rbp + 0x288]
shl rax, 1
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x530]
call fcn.1401375b0
mov qword [rbp + 0x290], rax
cmp qword [rbp + 0x288], 0x7fffffff
jae 0x1400123cb
cmp qword [rbp + 0x278], 0x7fffffff
ja 0x1400123cb
mov eax, dword [rbp + 0x288]
inc eax
mov r9d, eax
mov r8, qword [rbp + 0x290]
mov edx, dword [rbp + 0x278]
mov rcx, qword [rbp + 0x280]
call fcn.1401370a0
mov rax, qword [rbp + 0x5a0]
cmp dword [rax + 0xdfc], 0
jne 0x140011b60
mov qword [rbp + 0x538], 0xffffffff80000002
jmp 0x140011b6b
mov qword [rbp + 0x538], 0xffffffff80000001
lea r8, [rbp + 0x268]
mov rdx, qword [rbp + 0x290]
mov rcx, qword [rbp + 0x538]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1400123cb
mov qword [rbp + 0x2a8], 0
mov rax, qword [rbp + 0x5a0]
mov eax, dword [rax + 0x298]
and eax, 0x40
test eax, eax
jne 0x140012193
mov rax, qword [rbp + 0x5a0]
add rax, 0xd54
lea r8, [rbp + 0x2a8]
mov edx, 0x30
mov rcx, rax
call fcn.1401473a0
mov dword [rbp + 0x29c], eax
cmp dword [rbp + 0x29c], 0
jle 0x140011cc2
cmp qword [rbp + 0x2a8], 0
je 0x140011cc2
mov dword [rbp + 0x298], 0
jmp 0x140011c0d
mov eax, dword [rbp + 0x298]
inc eax
mov dword [rbp + 0x298], eax
mov eax, dword [rbp + 0x29c]
cmp dword [rbp + 0x298], eax
jge 0x140011c71
movsxd rax, dword [rbp + 0x298]
mov rcx, qword [rbp + 0x2a8]
movsx eax, byte [rcx + rax]
cmp eax, 0x2b
jne 0x140011c46
movsxd rax, dword [rbp + 0x298]
mov rcx, qword [rbp + 0x2a8]
mov byte [rcx + rax], 0x40
jmp 0x140011c6f
movsxd rax, dword [rbp + 0x298]
mov rcx, qword [rbp + 0x2a8]
movsx eax, byte [rcx + rax]
cmp eax, 0x2f
jne 0x140011c6f
movsxd rax, dword [rbp + 0x298]
mov rcx, qword [rbp + 0x2a8]
mov byte [rcx + rax], 0x24
jmp 0x140011bff
mov eax, dword [rbp + 0x29c]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x2a8]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1404db5f0]
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 1
mov rcx, qword [rbp + 0x2a8]
call fcn.1403ba8b0
mov qword [rbp + 0x2a8], 0
jmp 0x140011cd7
lea rdx, str.NodeId
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop
mov rax, qword [rbp + 0x5a0]
add rax, 0xc10
lea r8, [0x14058a640]
mov edx, 0x30
mov rcx, rax
call fcn.140131d30
lea rcx, [0x14058a640]
call fcn.14038b0f0
mov dword [rsp + 0x28], eax
lea rax, [0x14058a640]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.AgentHash
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 0x400
lea rcx, [0x1404db60c]
call fcn.140001180
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x1404db614]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
test eax, eax
jne 0x140011d86
lea rdx, [0x1404db61c]
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop
jmp 0x140011f09
mov edx, 0x400
lea rcx, [0x1404db624]
call fcn.140001180
mov qword [rsp + 0x20], 0x10000
lea r9, [0x14057a640]
mov r8, rax
lea rdx, [0x1404db62c]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov dword [rbp + 0x29c], eax
cmp dword [rbp + 0x29c], 0
jle 0x140011ef4
lea r8, [rbp + 0x2a8]
mov edx, dword [rbp + 0x29c]
lea rcx, [0x14057a640]
call fcn.1401473a0
mov dword [rbp + 0x29c], eax
cmp dword [rbp + 0x29c], 0
jle 0x140011edd
cmp qword [rbp + 0x2a8], 0
je 0x140011edd
mov dword [rbp + 0x298], 0
jmp 0x140011e28
mov eax, dword [rbp + 0x298]
inc eax
mov dword [rbp + 0x298], eax
mov eax, dword [rbp + 0x29c]
cmp dword [rbp + 0x298], eax
jge 0x140011e8c
movsxd rax, dword [rbp + 0x298]
mov rcx, qword [rbp + 0x2a8]
movsx eax, byte [rcx + rax]
cmp eax, 0x2b
jne 0x140011e61
movsxd rax, dword [rbp + 0x298]
mov rcx, qword [rbp + 0x2a8]
mov byte [rcx + rax], 0x40
jmp 0x140011e8a
movsxd rax, dword [rbp + 0x298]
mov rcx, qword [rbp + 0x2a8]
movsx eax, byte [rcx + rax]
cmp eax, 0x2f
jne 0x140011e8a
movsxd rax, dword [rbp + 0x298]
mov rcx, qword [rbp + 0x2a8]
mov byte [rcx + rax], 0x24
jmp 0x140011e1a
mov eax, dword [rbp + 0x29c]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x2a8]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1404db634]
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 1
mov rcx, qword [rbp + 0x2a8]
call fcn.1403ba8b0
mov qword [rbp + 0x2a8], 0
jmp 0x140011ef2
lea rdx, [0x1404db63c]
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop
jmp 0x140011f09
lea rdx, str.MeshId
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop
mov dword [rsp + 0x28], 0x1a
lea rax, [0x1404db650]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.CommitDate
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 0x400
lea rcx, [0x1404db680]
call fcn.140001180
mov qword [rsp + 0x20], 0x10000
lea r9, [0x14057a640]
mov r8, rax
lea rdx, [0x1404db690]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x140011f95
lea rdx, [0x1404db6a0]
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop
jmp 0x140011fcf
lea rcx, [0x14057a640]
call fcn.14038b0f0
mov dword [rsp + 0x28], eax
lea rax, [0x14057a640]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.MeshServerUrl
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop
mov edx, 0x400
lea rcx, [0x1404db6c0]
call fcn.140001180
mov qword [rsp + 0x20], 0x10000
lea r9, [0x14057a640]
mov r8, rax
lea rdx, [0x1404db6d0]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x14001202a
lea rdx, [0x1404db6e0]
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop
jmp 0x140012064
lea rcx, [0x14057a640]
call fcn.14038b0f0
mov dword [rsp + 0x28], eax
lea rax, [0x14057a640]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.MeshServerId
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop
mov edx, 0x400
lea rcx, [0x1404db700]
call fcn.140001180
mov qword [rsp + 0x20], 0x10000
lea r9, [0x14057a640]
mov r8, rax
lea rdx, str.WebProxy
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x1400120bf
lea rdx, [0x1404db71c]
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop
jmp 0x1400120f9
lea rcx, [0x14057a640]
call fcn.14038b0f0
mov dword [rsp + 0x28], eax
lea rax, [0x14057a640]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Proxy
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop
mov edx, 0x400
lea rcx, [0x1404db72c]
call fcn.140001180
mov qword [rsp + 0x20], 0x10000
lea r9, [0x14057a640]
mov r8, rax
lea rdx, [0x1404db730]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x140012154
lea rdx, [0x1404db734]
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop
jmp 0x14001218e
lea rcx, [0x14057a640]
call fcn.14038b0f0
mov dword [rsp + 0x28], eax
lea rax, [0x14057a640]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1404db738]
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop
jmp 0x1400122b9
mov rax, qword [rbp + 0x5a0]
add rax, 0xd54
lea r8, [rbp + 0x2a8]
mov edx, 0x30
mov rcx, rax
call fcn.1401473a0
mov dword [rbp + 0x29c], eax
cmp dword [rbp + 0x29c], 0
jle 0x1400122a4
cmp qword [rbp + 0x2a8], 0
je 0x1400122a4
mov dword [rbp + 0x298], 0
jmp 0x1400121ef
mov eax, dword [rbp + 0x298]
inc eax
mov dword [rbp + 0x298], eax
mov eax, dword [rbp + 0x29c]
cmp dword [rbp + 0x298], eax
jge 0x140012253
movsxd rax, dword [rbp + 0x298]
mov rcx, qword [rbp + 0x2a8]
movsx eax, byte [rcx + rax]
cmp eax, 0x2b
jne 0x140012228
movsxd rax, dword [rbp + 0x298]
mov rcx, qword [rbp + 0x2a8]
mov byte [rcx + rax], 0x40
jmp 0x140012251
movsxd rax, dword [rbp + 0x298]
mov rcx, qword [rbp + 0x2a8]
movsx eax, byte [rcx + rax]
cmp eax, 0x2f
jne 0x140012251
movsxd rax, dword [rbp + 0x298]
mov rcx, qword [rbp + 0x2a8]
mov byte [rcx + rax], 0x24
jmp 0x1400121e1
mov eax, dword [rbp + 0x29c]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x2a8]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1404db740]
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 1
mov rcx, qword [rbp + 0x2a8]
call fcn.1403ba8b0
mov qword [rbp + 0x2a8], 0
jmp 0x1400122b9
lea rdx, str.DiagnosticAgentNodeId
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop
mov edx, 0x400
lea rcx, [0x1404db770]
call fcn.140001180
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.SelfNodeCert
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
test eax, eax
jne 0x1400123bd
mov dword [rbp + 0x2b4], 0
mov edx, 0x400
lea rcx, [0x1404db790]
call fcn.140001180
mov qword [rsp + 0x20], 0x1000
lea r9, [0x14058a640]
mov r8, rax
lea rdx, [0x1404db798]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov dword [rbp + 0x2b4], eax
cmp dword [rbp + 0x2b4], 0
je 0x14001237d
cmp dword [rbp + 0x2b4], 0x30
jne 0x14001237d
movsxd rax, dword [rbp + 0x2b4]
mov rcx, qword [rbp + 0x5a0]
add rcx, 0xd54
mov r8, rax
lea rdx, [0x14058a640]
call fcn.1404104c0
test eax, eax
je 0x1400123bd
mov rax, qword [rbp + 0x5a0]
add rax, 0xd54
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x30
mov r9, rax
mov r8d, 6
lea rdx, str.NodeID
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015bc30
nop
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp + 0x280]
call fcn.140137da0
mov rcx, qword [rbp + 0x290]
call fcn.140137da0
mov rax, qword [rbp + 0x5a0]
cmp qword [rax + 0xc98], 0
jne 0x140012413
lea r9, [0x14000f250]
xor r8d, r8d
xor edx, edx
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x40]
call fcn.140162a90
nop
jmp 0x140012449
mov rax, qword [rbp + 0x5a0]
add rax, 0xc98
lea r9, [0x14000f250]
mov rcx, qword [rbp + 0x5a0]
mov r8, qword [rcx + 0xc80]
mov rdx, rax
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x40]
call fcn.140162a90
nop
cmp dword [rbp + 0x5b8], 0
je 0x1400124b4
cmp dword [rbp + 0x5a8], 1
je 0x1400124b4
cmp dword [rbp + 0x5a8], 2
jne 0x1400132e2
mov eax, 8
imul rax, rax, 1
lea rdx, [0x1404db7a8]
mov rcx, qword [rbp + 0x5b0]
mov rcx, qword [rcx + rax]
call fcn.14038a9d0
test eax, eax
je 0x1400124b4
mov eax, 8
imul rax, rax, 1
lea rdx, [0x1404db7b0]
mov rcx, qword [rbp + 0x5b0]
mov rcx, qword [rcx + rax]
call fcn.14038a9d0
test eax, eax
jne 0x1400132e2
xor r8d, r8d
lea rdx, str..update.exe
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x38]
call fcn.140002670
mov qword [rbp + 0x2b8], rax
mov rcx, qword [rbp + 0x2b8]
call fcn.1401328e0
xor r8d, r8d
lea rdx, str..corereset
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x38]
call fcn.140002670
mov qword [rbp + 0x2b8], rax
mov rcx, qword [rbp + 0x2b8]
call fcn.14015b4a0
test eax, eax
je 0x14001254a
mov edx, 0x400
lea rcx, [0x1404db7d8]
call fcn.140001180
mov r8, rax
lea rdx, [0x1404db7e8]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015d270
mov rcx, qword [rbp + 0x2b8]
call fcn.1401328e0
nop
mov rax, qword [rbp + 0x5a0]
cmp dword [rax + 0x28c], 0
jne 0x140012599
mov edx, 0x400
lea rcx, [0x1404db7f8]
call fcn.140001180
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x1404db808]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov dword [rbp + 0x540], eax
jmp 0x1400125a3
mov dword [rbp + 0x540], 0
mov eax, dword [rbp + 0x540]
mov dword [rbp + 0x2c8], eax
mov edx, 0x400
lea rcx, [0x1404db818]
call fcn.140001180
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x1404db828]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
test eax, eax
je 0x1400126c3
mov edx, 0x400
lea rcx, [0x1404db838]
call fcn.140001180
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rbp + 0x2d8]
mov r8, rax
lea rdx, str.jsDebugPort
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov dword [rbp + 0x2f4], eax
cmp dword [rbp + 0x2f4], 0
jle 0x1400126c3
cmp dword [rbp + 0x2f4], 0x10
jge 0x1400126c3
movsxd rax, dword [rbp + 0x2f4]
mov qword [rbp + 0x498], rax
cmp qword [rbp + 0x498], 0x10
jae 0x14001265f
jmp 0x140012665
call fcn.14037c0a0
nop
mov rax, qword [rbp + 0x498]
mov byte [rbp + rax + 0x2d8], 0
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0x2d8]
call fcn.140136ec0
cmp rax, 0x7fffffff
ja 0x1400126a6
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0x2d8]
call fcn.140136f40
mov dword [rbp + 0x544], eax
jmp 0x1400126b0
mov dword [rbp + 0x544], 0
mov rax, qword [rbp + 0x5a0]
mov ecx, dword [rbp + 0x544]
mov dword [rax + 0xc00], ecx
mov rax, qword [rbp + 0x5a0]
mov dword [rax + 0x290], 1
mov edx, 0x400
lea rcx, [0x1404db858]
call fcn.140001180
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.showModuleNames
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov dword [0x1405767f8], eax
mov rax, qword [rbp + 0x5a0]
cmp qword [rax + 0x10], 0
je 0x1400127c0
mov rax, qword [rbp + 0x5a0]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.14000aa90
lea r8, [0x1404db878]
mov edx, 0xffffffff
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.14003bf90
mov edx, 0xfffffffe
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.140033b00
lea rdx, str.Ready
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.140035090
mov edx, 1
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.14003f030
test eax, eax
je 0x1400127af
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.1400e2890
nop
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.140036e50
nop
mov rax, qword [rbp + 0x5a0]
cmp dword [rax + 0x28c], 0
jne 0x140012bd1
call fcn.140117cd0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov rcx, qword [rbp + 0x5a0]
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rbp + 0x5a0]
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbp + 0x5a0]
mov rcx, qword [rcx + 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x5a0]
mov r9, qword [rcx]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140117de0
mov rcx, qword [rbp + 0x5a0]
mov qword [rcx + 0x10], rax
mov r8, qword [rbp + 0x5a0]
mov rax, qword [rbp + 0x5a0]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.14000b670
mov r8, qword [rbp + 0x5a0]
lea rdx, [0x14000fb30]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.1400e2730
mov edx, 0x400
lea rcx, [0x1404db888]
call fcn.140001180
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.coreDumpEnabled
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov dword [rbp + 0x548], eax
mov rax, qword [rbp + 0x5a0]
mov ecx, dword [rbp + 0x548]
mov dword [rax + 0xc04], ecx
cmp dword [rbp + 0x548], 0
je 0x1400128ff
mov r9d, 0xf08
xor r8d, r8d
lea rdx, str.process.coreDumpLocation__process.platformwin32__process.execPath.replace_.exe__.dmp__:_process.execPath__.dmp__
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.14003f390
nop
mov edx, 0x400
lea rcx, [0x1404db930]
call fcn.140001180
mov qword [rsp + 0x20], 0x1000
lea r9, [0x14058a640]
mov r8, rax
lea rdx, str.finalizer_messages
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
test eax, eax
je 0x140012950
lea rcx, [0x14058a640]
call fcn.140390300
mov dword [0x140577190], eax
cmp dword [rbp + 0x2c8], 4
jle 0x140012bd1
mov edx, 0x400
lea rcx, [0x1404db960]
call fcn.140001180
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.noUpdateCoreModule
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
test eax, eax
je 0x140012b1c
mov rax, qword [rbp + 0x5a0]
mov dword [rax + 0x28c], 1
lea rcx, str._CoreModule:_Update_Disabled_n
call fcn.140015e70
movsxd rax, dword [rbp + 0x2c8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140138010
mov qword [rbp + 0x2c0], rax
movsxd rax, dword [rbp + 0x2c8]
mov qword [rbp + 0x550], rax
mov edx, 0x400
lea rcx, [0x1404db9b8]
call fcn.140001180
mov rcx, qword [rbp + 0x550]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x2c0]
mov r8, rax
lea rdx, [0x1404db9c8]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov eax, dword [rbp + 0x2c8]
sub eax, 4
mov rcx, qword [rbp + 0x2c0]
add rcx, 4
mov dword [rsp + 0x20], reloc.WS2_32.dll_listen
lea r9, [0x1404db9d8]
mov r8d, eax
mov rdx, rcx
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.140118ba0
test eax, eax
jne 0x140012a78
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.140118cf0
test eax, eax
je 0x140012b05
mov rax, qword [rbp + 0x5a0]
cmp qword [rax], 0
je 0x140012aae
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rbp + 0x5a0]
add rax, qword [rcx]
mov ecx, 8
imul rcx, rcx, 0
mov rax, qword [rax + rcx]
mov qword [rbp + 0x558], rax
jmp 0x140012ab9
mov qword [rbp + 0x558], 0
xor r8d, r8d
mov edx, 0xffffffff
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.14003ab50
mov qword [rsp + 0x20], rax
lea r9, [0x1404db9e8]
mov r8d, 2
mov edx, 0x4100
mov rcx, qword [rbp + 0x558]
call fcn.1401589b0
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.140036e50
nop
mov edx, 1
mov rcx, qword [rbp + 0x2c0]
call fcn.1403ba8b0
nop
jmp 0x140012bd1
mov rax, qword [rbp + 0x5a0]
mov qword [rbp + 0x308], rax
lea rax, [0x140013400]
mov qword [rsp + 0x20], rax
mov r9d, 0xea60
mov r8d, 1
lea rdx, [rbp + 0x308]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.1400e3cf0
mov rcx, qword [rbp + 0x5a0]
mov qword [rcx + 0xbf8], rax
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.1400359b0
mov rax, qword [rbp + 0x5a0]
mov rdx, qword [rax + 0xbf8]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.140036c00
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0xbf8]
call fcn.1400e0d50
mov r8, rax
mov edx, 0xfffffffe
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.14003c230
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.140036e50
nop
mov edx, 0x400
lea rcx, [0x1404dba08]
call fcn.140001180
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x1404dba10]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
test eax, eax
jle 0x140012cc9
mov edx, 0x400
lea rcx, [0x1404dba18]
call fcn.140001180
mov qword [rsp + 0x20], 0x1000
lea r9, [0x14058a640]
mov r8, rax
lea rdx, str.exitPID
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov dword [rbp + 0x314], eax
mov edx, 0x1000
lea rcx, [0x14058a640]
call fcn.140136f40
mov r8d, eax
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x318], rax
cmp qword [rbp + 0x318], 0
je 0x140012cc9
mov edx, 0x156c
lea rcx, [0x1404dba28]
call fcn.14013f430
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x5a0]
mov qword [rsp + 0x20], rax
lea r9, [0x140013650]
mov r8d, 0xffffffff
mov rdx, qword [rbp + 0x318]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax]
call fcn.14013e9d0
nop
mov edx, 0x400
lea rcx, [0x1404dba68]
call fcn.140001180
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.hideConsole
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
test eax, eax
jle 0x140012d33
mov rax, qword [rbp + 0x5a0]
cmp qword [rax + 0x10], 0
je 0x140012d33
mov r9d, 0xf88
xor r8d, r8d
lea rdx, str.require_win_console_.hide__
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.14003f390
nop
mov edx, 0x400
lea rcx, [0x1404dbaa8]
call fcn.140001180
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.selfTest
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
test eax, eax
jne 0x140012d8c
mov r8, qword [rbp + 0x5a0]
lea rdx, [0x14000fb70]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax]
call fcn.140134e00
nop
mov rax, qword [rbp + 0x5a0]
cmp dword [rax + 0xc0c], 0
jne 0x140012dae
mov rcx, qword [rbp + 0x5a0]
call fcn.1400029e0
nop
jmp 0x140012f73
mov edx, 0x400
lea rcx, [0x1404dbac8]
call fcn.140001180
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x1404dbad8]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov dword [rbp + 0x2c8], eax
cmp dword [rbp + 0x2c8], 4
jle 0x140012f52
movsxd rax, dword [rbp + 0x2c8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140138010
mov qword [rbp + 0x2c0], rax
movsxd rax, dword [rbp + 0x2c8]
mov qword [rbp + 0x560], rax
mov edx, 0x400
lea rcx, [0x1404dbae8]
call fcn.140001180
mov rcx, qword [rbp + 0x560]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x2c0]
mov r8, rax
lea rdx, [0x1404dbaf8]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov eax, dword [rbp + 0x2c8]
sub eax, 4
mov rcx, qword [rbp + 0x2c0]
add rcx, 4
mov dword [rsp + 0x20], reloc.WS2_32.dll_listen
lea r9, [0x1404dbb08]
mov r8d, eax
mov rdx, rcx
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.140118ba0
test eax, eax
jne 0x140012eb3
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.140118cf0
test eax, eax
je 0x140012f30
mov rax, qword [rbp + 0x5a0]
cmp qword [rax], 0
je 0x140012ee9
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rbp + 0x5a0]
add rax, qword [rcx]
mov ecx, 8
imul rcx, rcx, 0
mov rax, qword [rax + rcx]
mov qword [rbp + 0x568], rax
jmp 0x140012ef4
mov qword [rbp + 0x568], 0
xor r8d, r8d
mov edx, 0xffffffff
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.14003ab50
mov qword [rsp + 0x20], rax
lea r9, str.Error_Executing_MeshCore:__s
mov r8d, 2
mov edx, 0x4100
mov rcx, qword [rbp + 0x568]
call fcn.1401589b0
nop
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.140036e50
mov edx, 1
mov rcx, qword [rbp + 0x2c0]
call fcn.1403ba8b0
nop
mov r9d, 0xf88
xor r8d, r8d
lea rdx, str.console.log_Agent_running_in_Local_Debug_Mode__require_MeshAgent_.emit_Connected_1__
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x10]
call fcn.14003f390
nop
mov edx, 0x400
lea rcx, [0x1404dbba0]
call fcn.140001180
mov qword [rsp + 0x20], 0x1000
lea r9, [0x14058a640]
mov r8, rax
lea rdx, [0x1404dbbb0]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
cmp eax, 5
jle 0x1400132db
mov r8d, 5
lea rdx, [0x1404dbbbc]
lea rcx, [0x14058a640]
call fcn.1404104c0
test eax, eax
jne 0x1400132db
mov edx, 0x400
lea rcx, [0x1404dbbc8]
call fcn.140001180
mov qword [rsp + 0x20], 0x1000
lea r9, [0x14058a640]
mov r8, rax
lea rdx, str.DiscoveryKey
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0x48]
call fcn.14015c4e0
mov dword [rbp + 0x484], eax
cmp dword [rbp + 0x484], 1
jle 0x140013110
lea rcx, [rbp + 0x3a0]
call fcn.1401a2d10
mov eax, dword [rbp + 0x484]
dec eax
cdqe
mov r8, rax
lea rdx, [0x14058a640]
lea rcx, [rbp + 0x3a0]
call fcn.1401a2e40
lea rdx, [rbp + 0x3a0]
lea rcx, [0x14058a640]
call fcn.1401a2ce0
mov r9d, 0x159d
lea r8, [0x1404dbbe8]
mov edx, 1
mov ecx, 0x20
call fcn.1403ba980
mov qword [rbp + 0x570], rax
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rbp + 0x570]
mov qword [rax + 0xda0], rcx
cmp qword [rbp + 0x570], 0
jne 0x1400130ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x159d
lea rdx, [0x1404dbc28]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x159d
lea rdx, [0x1404dbc68]
lea rcx, [0x1404dbca8]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
mov r8d, 0x20
lea rdx, [0x14058a640]
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax + 0xda0]
call fcn.1404105c0
nop
mov r8d, reloc.WS2_32.dll_recv
xor edx, edx
lea rcx, [rbp + 0x328]
call fcn.140410c60
mov r8d, 0x1c
xor edx, edx
lea rcx, [rbp + 0x358]
call fcn.140410c60
call fcn.14014bbd0
test eax, eax
je 0x140013177
mov eax, reloc.WS2_32.dll_socket
mov word [rbp + 0x358], ax
mov cx, 0x425d
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x35a], ax
lea r8, [rbp + 0x360]
lea rdx, str.FF02:0:0:0:0:0:0:FE
mov ecx, reloc.WS2_32.dll_socket
call fcn.14014bec0
nop
mov eax, 2
mov word [rbp + 0x328], ax
mov cx, 0x425d
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x32a], ax
lea r8, [rbp + 0x32c]
lea rdx, str.239.255.255.235
mov ecx, 2
call fcn.14014bec0
mov dword [rsp + 0x38], 1
mov rax, qword [rbp + 0x5a0]
mov qword [rsp + 0x30], rax
lea rax, [0x140007a00]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x358]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x328]
mov r8w, 0x425e
mov edx, 0x400
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax]
call fcn.140136130
mov rcx, qword [rbp + 0x5a0]
mov qword [rcx + 0xd90], rax
mov rax, qword [rbp + 0x5a0]
cmp qword [rax + 0xd90], 0
jne 0x140013246
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xdb
mov r8d, 0x15b5
lea rdx, [0x1404dbcf8]
xor ecx, ecx
call fcn.14014da80
nop
mov eax, 1
jmp 0x1400132e4
mov dword [rsp + 0x38], 1
mov rax, qword [rbp + 0x5a0]
mov qword [rsp + 0x30], rax
lea rax, [0x140007a00]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x358]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x328]
xor r8d, r8d
mov edx, 0x400
mov rax, qword [rbp + 0x5a0]
mov rcx, qword [rax]
call fcn.140136130
mov rcx, qword [rbp + 0x5a0]
mov qword [rcx + 0xd98], rax
mov rax, qword [rbp + 0x5a0]
cmp qword [rax + 0xd98], 0
jne 0x1400132db
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xdb
mov r8d, 0x15b9
lea rdx, [0x1404dbd38]
xor ecx, ecx
call fcn.14014da80
nop
mov eax, 1
jmp 0x1400132e4
mov eax, 1
jmp 0x1400132e4
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, reloc.WS2_32.dll_ntohs
mov r8, qword [rbp + 0x4a8]
call fcn.14037c390
mov rax, rdi
mov rcx, qword [rbp + 0x578]
xor rcx, rbp
call fcn.14037c650
lea rsp, [rbp + 0x588]
pop rdi
pop rbp
ret