Function at 0x1400025f0
Capabilities:
Create directory
Create http request
Delete file
Download and write a file
Encode data using xor
Get uefi variable
Query environment variable
Query service status
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3e40]
mov eax, 0x3f40
call fcn.1400046b0
sub rsp, rax
mov rax, qword [0x14002e040]
xor rax, rsp
mov qword [rbp + 0x3e30], rax
xor r15b, r15b
movsxd r14, ecx
xor edi, edi
mov r12, rdx
cmp r14, 1
jle 0x14000269f
mov esi, 1
lea r13, str._debug
nop dword [rax + rax]
mov rbx, qword [r12 + rsi*8]
lea rdx, str._version
mov rcx, rbx
call fcn.14001ef60
test eax, eax
je 0x1400027c0
mov rcx, rdi
nop
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [rcx + r13 - 1]
jne 0x1400027aa
cmp rcx, 7
jne 0x140002670
inc rsi
mov r15b, 1
cmp rsi, r14
jl 0x140002650
lea rcx, str.Debug_mode_enabled._n
call fcn.140001030
mov r14, 0xffffffffffffffff
lea rsi, str._shj32XdkL
movabs r12, 0xcccccccccccccccd
nop word [rax + rax]
lea r8, [0x140029c80]
mov edx, 0x104
lea rcx, [rbp + 0x630]
call fcn.14000fe80
lea rax, [rbp + 0x630]
mov r8, r14
inc r8
cmp word [rax + r8*2], di
jne 0x1400026e2
mov r9, rdi
test r8, r8
je 0x14000272c
nop dword [rax]
nop dword [rax + rax]
mov rcx, r9
mov rax, r12
mul r9
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
sub rcx, rax
movzx eax, word [rsi + rcx*2]
xor word [rbp + r9*2 + 0x630], ax
inc r9
cmp r9, r8
jb 0x140002700
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea rcx, str.InternetConnectionChecker
mov edx, 1
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbx, rax
test rax, rax
je 0x140002785
mov qword [rsp + 0x28], rdi
lea rdx, [rbp + 0x630]
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
test rax, rax
jne 0x1400027fe
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
cmp byte [0x14002fd10], dil
je 0x14000279a
lea rcx, str.Waiting_for_internet_connection..._n
call fcn.140001030
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400026c0
mov rdx, rbx
lea rcx, str.Unknown_argument:__s_n
call fcn.1400010f0
mov eax, 1
jmp 0x1400027ce
lea rcx, str.FWPUpdater_Version_0.3.7.2_n
call fcn.1400010f0
xor eax, eax
mov rcx, qword [rbp + 0x3e30]
xor rcx, rsp
call fcn.140003e30
lea r11, [rsp + 0x3f40]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test r15b, r15b
je 0x140002821
lea rcx, str.Internet_connection_established._n
call fcn.140001030
lea r8, [0x140029cb0]
mov edx, 0x104
lea rcx, [rbp + 0x420]
call fcn.14000fe80
lea rax, [rbp + 0x420]
mov rcx, r14
inc rcx
cmp word [rax + rcx*2], di
jne 0x140002843
mov r9, r14
nop
inc r9
cmp word [rsi + r9*2], di
jne 0x140002850
mov r8, rdi
test rcx, rcx
je 0x14000287f
xor edx, edx
mov rax, r8
div r9
movzx eax, word [rsi + rdx*2]
xor word [rbp + r8*2 + 0x420], ax
inc r8
cmp r8, rcx
jb 0x140002862
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea rcx, str.MyDownloader
mov edx, 1
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbx, rax
test rax, rax
jne 0x1400028c9
cmp byte [0x14002fd10], dil
je 0x14000295e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.InternetOpen_failed_with_error__lu_n
call fcn.140001030
jmp 0x14000295e
mov qword [rsp + 0x28], rdi
lea rdx, [rbp + 0x420]
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rsi, rax
test rax, rax
jne 0x140002913
cmp byte [0x14002fd10], dil
je 0x140002955
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.InternetOpenUrl_failed_with_error__lu_n
call fcn.140001030
jmp 0x140002955
lea r9, [rsp + 0x48]
mov r8d, 0x20
lea rdx, [rbp - 0x50]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140002979
cmp byte [0x14002fd10], dil
je 0x14000294c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.InternetReadFile_failed_with_error__lu_n
call fcn.140001030
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test r15b, r15b
je 0x14000296f
lea rcx, str.Failed_to_fetch_MD5_from_server_n
call fcn.140001030
mov eax, 1
jmp 0x1400027ce
mov eax, dword [rsp + 0x48]
mov rcx, rsi
mov byte [rbp + rax - 0x50], dil
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor edx, edx
xor ecx, ecx
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x1400029d0
cmp byte [0x14002fd10], dil
je 0x1400029c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed_with_error__lu_n
call fcn.140001030
mov eax, edi
jmp 0x140002a5e
mov r8d, 4
lea rdx, str.CucoAgent
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r12, rax
test rax, rax
jne 0x1400029fb
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
jmp 0x140002a5e
lea rax, [rsp + 0x48]
mov r9d, 0x24
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, r12
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
jne 0x140002a54
cmp byte [0x14002fd10], dil
je 0x1400029c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.QueryServiceStatusEx_failed_with_error__lu_n
call fcn.140001030
mov eax, edi
jmp 0x140002a5e
cmp dword [rsp + 0x64], 4
mov eax, edi
sete al
test eax, eax
je 0x140002d2e
xor edx, edx
xor ecx, ecx
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140002aa4
cmp byte [0x14002fd10], dil
je 0x140002bb3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed_with_error__lu_n
call fcn.140001030
jmp 0x140002bb3
mov r8d, 1
lea rdx, str.CucoAgent
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x140002ae8
cmp byte [0x14002fd10], dil
je 0x140002baa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService_failed_with_error__lu_n
call fcn.140001030
jmp 0x140002baa
lea r9, [rsp + 0x48]
mov dword [rsp + 0x48], edi
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x140002b2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140002b2b
cmp byte [0x14002fd10], dil
je 0x140002ba1
lea rcx, str.QueryServiceConfig_failed_with_error__lu_n
mov edx, eax
call fcn.140001030
jmp 0x140002ba1
mov edx, dword [rsp + 0x48]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r13, rax
test rax, rax
jne 0x140002b61
cmp byte [0x14002fd10], dil
je 0x140002ba1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LocalAlloc_failed_with_error__lu_n
call fcn.140001030
jmp 0x140002ba1
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
mov rdx, r13
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x140002bd2
cmp byte [0x14002fd10], dil
je 0x140002b98
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.QueryServiceConfig_failed_with_error__lu_n
call fcn.140001030
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r15b, r15b
je 0x14000296f
lea rcx, str.Failed_to_get_executable_path_for_CucoAgent_n
call fcn.140001030
mov eax, 1
jmp 0x1400027ce
mov r8, qword [r13 + 0x10]
lea rcx, [rbp + 0x630]
mov edx, 0x104
call fcn.14000fe80
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x630]
call fcn.1400013e0
test eax, eax
jne 0x140002c35
test r15b, r15b
je 0x14000296f
lea rcx, str.Failed_to_compute_MD5_hash_of_the_local_agent_executable_n
call fcn.140001030
mov eax, 1
jmp 0x1400027ce
lea rax, [rbp - 0x50]
lea r8, [rbp - 0x28]
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140002c53
inc rax
test ecx, ecx
jne 0x140002c40
test edx, edx
je 0x140002e54
test r15b, r15b
je 0x140002c6c
lea rcx, str.MD5_hash_mismatch._Updating_agent..._n
call fcn.140001030
lea r9, [rbp + 0x630]
mov edx, 0x104
lea r8, str._s_stop
lea rcx, [rbp + 0x1630]
call fcn.140001090
lea rcx, [rbp + 0x1630]
call fcn.140002500
test eax, eax
jne 0x140002cba
test r15b, r15b
je 0x14000296f
lea rcx, str.Failed_to_stop_agent_service_n
call fcn.140001030
mov eax, 1
jmp 0x1400027ce
lea r9, [rbp + 0x630]
mov edx, 0x104
lea r8, str._s_remove
lea rcx, [rbp + 0x1630]
call fcn.140001090
lea rcx, [rbp + 0x1630]
call fcn.140002500
test eax, eax
jne 0x140002d08
test r15b, r15b
je 0x14000296f
lea rcx, str.Failed_to_remove_agent_service_n
call fcn.140001030
mov eax, 1
jmp 0x1400027ce
lea rcx, [rbp + 0x630]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140002e2d
test r15b, r15b
je 0x140002d2e
lea rcx, str.Successfully_deleted_agent_executable._n
call fcn.140001030
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x40]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140002dfa
lea r8, [rsp + 0x54]
xor ecx, ecx
lea rdx, str.SeSystemEnvironmentPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x50]
mov r12d, 0x10
mov qword [rsp + 0x28], rdi
mov r9d, r12d
mov dword [rsp + 0x50], 1
xor edx, edx
mov dword [rsp + 0x5c], 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140002dfa
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
je 0x140002dfa
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x800
lea r8, [rbp + 0x1630]
lea rdx, str.12BBACA3_7551_4891_AC55_C75E2E14A917
lea rcx, str.CuCoTicket
call qword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
test eax, eax
jne 0x140002e6e
cmp byte [0x14002fd10], dil
je 0x140002dfa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetFirmwareEnvironmentVariable_failed_with_error__lu_n
call fcn.140001030
lea rcx, [rbp + 0x2e30]
call fcn.140001680
test eax, eax
jne 0x140002f0e
test r15b, r15b
je 0x14000296f
lea rcx, str.Failed_to_retrieve_BIOS_serial_number_n
call fcn.140001030
mov eax, 1
jmp 0x1400027ce
test r15b, r15b
je 0x14000296f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_delete_agent_executable._Error__lu_n
call fcn.140001030
mov eax, 1
jmp 0x1400027ce
test r15b, r15b
je 0x1400027cc
lea rcx, str.The_CucoAgent_Service_exists_and_the_MD5_hashes_match._n
call fcn.140001030
jmp 0x1400027cc
xorps xmm0, xmm0
lea rbx, [rbp + 0x1644]
xor eax, eax
lea rsi, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
mov word [rbp - 0x60], ax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
nop word [rax + rax]
movzx r9d, byte [rbx]
lea r8, str._02X
mov edx, 3
mov rcx, rsi
call fcn.140001090
add rsi, 4
lea rbx, [rbx - 1]
sub r12, 1
jne 0x140002ea0
mov r9, r14
lea r8, [rsp + 0x60]
mov edx, 0x800
lea rcx, [rbp + 0x1e30]
call fcn.140010378
lea rcx, [rbp + 0x1e30]
call fcn.140001ba0
test eax, eax
jne 0x140002f3d
test r15b, r15b
je 0x14000296f
lea rcx, str.CUCOID_not_found_on_server_n
call fcn.140001030
mov eax, 1
jmp 0x1400027ce
lea rcx, [rbp + 0x2e30]
call fcn.140002050
test eax, eax
jne 0x140002f3d
test r15b, r15b
je 0x14000296f
lea rcx, str.Serial_number_not_found_on_server_n
call fcn.140001030
mov eax, 1
jmp 0x1400027ce
mov r8d, 0x104
lea rdx, [0x14002fd30]
lea rcx, str.SystemDrive
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x140002f86
cmp byte [0x14002fd10], dil
je 0x14000296f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetEnvironmentVariable_failed_with_error__lu_n
call fcn.140001030
mov eax, 1
jmp 0x1400027ce
lea r9, [0x14002fd30]
mov edx, 0x104
lea r8, str._sRecoveryOEMScripts
lea rcx, [rbp + 0x210]
call fcn.140001090
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x208
call fcn.14001e480
lea r8, [rbp + 0x210]
mov edx, 0x104
lea rcx, [rbp]
call fcn.14000fe80
lea rax, [rbp]
nop
inc r14
cmp word [rax + r14*2], di
jne 0x140002fd0
test r14, r14
je 0x140003003
cmp word [rbp + r14*2 - 2], 0x5c
jne 0x140003003
lea r14, [r14*2 - 2]
cmp r14, 0x208
jae 0x140003360
mov word [rbp + r14], di
movzx eax, word [rbp + 2]
lea rbx, [rbp + 2]
test ax, ax
je 0x140003048
cmp ax, 0x5c
jne 0x14000303b
xor edx, edx
mov word [rbx], di
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140003036
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140003065
mov word [rbx], 0x5c
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x140003010
xor edx, edx
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000308f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000308f
cmp byte [0x14002fd10], dil
je 0x14000296f
mov r8d, eax
lea rdx, [rbp]
lea rcx, str.CreateDirectory_failed_for__s_with_error__lu_n
call fcn.140001030
mov eax, 1
jmp 0x1400027ce
mov rax, qword [0x14002fd20]
cmp qword [0x14002fd18], rax
je 0x1400027cc
xor ecx, ecx
call fcn.14000fee8
mov ecx, eax
call fcn.14000fcc0
mov rbx, qword [0x14002fd20]
sub rbx, qword [0x14002fd18]
sar rbx, 5
call fcn.14000fc94
xor edx, edx
cdqe
div rbx
lea r9, [rbp + 0x210]
movsxd rbx, edx
lea r8, str._s_agent.exe
shl rbx, 5
lea rcx, [rbp + 0x1630]
add rbx, qword [0x14002fd18]
mov edx, 0x104
call fcn.140001090
cmp qword [rbx + 0x18], 0xf
mov rsi, rbx
jbe 0x140003109
mov rsi, qword [rbx]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea rcx, str.MyDownloader
mov edx, 1
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r13, rax
test rax, rax
jne 0x140003153
cmp byte [0x14002fd10], dil
je 0x14000327d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.InternetOpen_failed_with_error__lu_n
call fcn.140001030
jmp 0x14000327d
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x80000000
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov r14, rax
test rax, rax
jne 0x1400031a5
cmp byte [0x14002fd10], dil
je 0x140003197
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.InternetOpenUrl_failed_with_error__lu_n
call fcn.140001030
mov rcx, r13
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14000327d
mov qword [rsp + 0x30], rdi
lea rcx, [rbp + 0x1630]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x140003210
cmp byte [0x14002fd10], dil
je 0x1400031f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateFile_failed_with_error__lu_n
call fcn.140001030
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r13
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14000327d
lea r9, [rsp + 0x48]
mov r8d, 0x1000
lea rdx, [rbp + 0x630]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
mov esi, eax
test eax, eax
je 0x14000325e
mov ecx, dword [rsp + 0x48]
test ecx, ecx
je 0x14000325e
mov r8d, ecx
mov qword [rsp + 0x20], rdi
mov rcx, r12
lea r9, [rsp + 0x40]
lea rdx, [rbp + 0x630]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x48]
test ecx, ecx
jne 0x140003210
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r13
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test esi, esi
jne 0x1400032a4
test r15b, r15b
je 0x1400027cc
cmp qword [rbx + 0x18], 0xf
jbe 0x140003290
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, str.Failed_to_download_file_from__S_n
call fcn.140001030
jmp 0x1400027cc
test r15b, r15b
je 0x1400032c2
cmp qword [rbx + 0x18], 0xf
jbe 0x1400032b3
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, str.Successfully_downloaded_file_from__S_n
call fcn.140001030
lea r9, [rbp + 0x210]
mov edx, 0x104
lea r8, str._s_agent.exe_install
lea rcx, [rbp + 0x630]
call fcn.140001090
lea rcx, [rbp + 0x630]
call fcn.140002500
test eax, eax
je 0x14000296f
lea r9, [rbp + 0x210]
mov edx, 0x104
lea r8, str._s_agent.exe_start
lea rcx, [rbp + 0x630]
call fcn.140001090
lea rcx, [rbp + 0x630]
call fcn.140002500
test eax, eax
je 0x14000296f
lea r9, [rbp + 0x210]
mov edx, 0x104
lea r8, str._s_agent.exe_run
lea rcx, [rbp + 0x630]
call fcn.140001090
lea rcx, [rbp + 0x630]
call fcn.140002500
test eax, eax
sete dil
mov eax, edi
jmp 0x1400027ce
call fcn.140003f60
int3