Function at 0x18000b700
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0xec0
mov qword [rsp + 0xeb0], 0xfffffffffffffffe
mov rax, qword [0x18021dd90]
xor rax, rsp
mov qword [rsp + 0xeb8], rax
cmp dword [0x1802369d4], 0
je 0x18000b735
jmp 0x18000bac5
mov dword [0x1802369d4], 1
mov dword [rsp + 0x84c], 0x400
mov byte [rsp + 0xa80], 0
lea rax, [rsp + 0xa81]
mov rdi, rax
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov dword [rsp + 0x858], 0
mov qword [rsp + 0x840], 0
xor eax, eax
mov word [rsp + 0x40], ax
lea rax, [rsp + 0x42]
mov rdi, rax
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov dword [rsp + 0xa70], 0x400
lea rax, [0x1801a6e60]
mov qword [rsp + 0x850], rax
mov dword [rsp + 0x30], 0
xor eax, eax
mov word [rsp + 0x860], ax
lea rax, [rsp + 0x862]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
call fcn.1800034e0
lea r9, str.OAgent.ini
mov r8, rax
lea rdx, [0x1801a7038]
lea rcx, [rsp + 0x860]
call fcn.1800f96e4
lea rax, [rsp + 0x860]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xa70]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x40]
mov r8, qword [rsp + 0x850]
lea rdx, [0x1801a8eb0]
lea rcx, str.AgentConfig
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jbe 0x18000b86f
mov eax, dword [rsp + 0xa70]
dec eax
mov eax, eax
movzx eax, word [rsp + rax*2 + 0x40]
test eax, eax
jne 0x18000b86f
mov r8d, 0x400
lea rdx, [rsp + 0xa80]
lea rcx, [rsp + 0x40]
call fcn.180135f20
mov dword [rsp + 0x858], eax
mov dword [rsp + 0x848], 0x20019
mov eax, dword [rsp + 0x848]
bts eax, 9
mov dword [rsp + 0x848], eax
cmp dword [rsp + 0x858], 0
jne 0x18000b980
lea rcx, [rsp + 0xe80]
call fcn.1800f3760
nop
mov r9d, dword [rsp + 0x848]
lea r8, str.SOFTWAREClassesCLSIDAFFAEF68_CDC5_4aad_9D3F_997C0D55927BProgID
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0xe80]
call fcn.1800f3160
test rax, rax
je 0x18000b965
lea r8, [rsp + 0x858]
lea rdx, [0x1801a8eb8]
lea rcx, [rsp + 0xe80]
call fcn.1800f1ec0
mov qword [rsp + 0x840], rax
cmp qword [rsp + 0x840], 0
je 0x18000b965
cmp dword [rsp + 0x858], 0x400
jae 0x18000b931
mov eax, dword [rsp + 0x858]
mov r8d, eax
mov rdx, qword [rsp + 0x840]
lea rcx, [rsp + 0xa80]
call fcn.1800fa0d0
jmp 0x18000b93c
mov dword [rsp + 0x858], 0
mov rax, qword [rsp + 0x840]
mov qword [rsp + 0xea8], rax
mov rcx, qword [rsp + 0xea8]
call fcn.1800f8898
mov qword [rsp + 0x840], 0
lea rcx, [rsp + 0xe80]
call fcn.1800f1d70
nop
lea rcx, [rsp + 0xe80]
call fcn.1800f30e0
cmp dword [rsp + 0x858], 0
jne 0x18000ba11
mov eax, dword [rsp + 0xa70]
shl rax, 1
mov r8, rax
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.1800f8660
mov eax, dword [rsp + 0xa70]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x40]
mov r8, qword [rsp + 0x850]
lea rdx, [0x1801a8eb8]
lea rcx, str.ED30_8AC4_11D5_8930_A730
call qword [sym.imp.KERNEL32.dll_GetProfileStringW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jbe 0x18000ba11
mov eax, dword [rsp + 0xa70]
dec eax
mov eax, eax
movzx eax, word [rsp + rax*2 + 0x40]
test eax, eax
jne 0x18000ba11
mov r8d, 0x400
lea rdx, [rsp + 0xa80]
lea rcx, [rsp + 0x40]
call fcn.180135f20
mov dword [rsp + 0x858], eax
cmp dword [rsp + 0x858], 0
je 0x18000bac5
mov eax, dword [rsp + 0x858]
cmp rax, 4
jbe 0x18000bac5
lea rax, [rsp + 0xa80]
mov qword [rsp + 0xe90], rax
cmp qword [rsp + 0xe90], 0
je 0x18000bac5
mov rax, qword [rsp + 0xe90]
cmp dword [rax], 1
je 0x18000bac5
mov rax, qword [rsp + 0xe90]
add rax, 4
mov qword [rsp + 0xea0], rax
mov rax, qword [rsp + 0xea0]
movzx eax, word [rax + 0x18]
mov rcx, qword [rsp + 0xea0]
lea rax, [rcx + rax*2 + 0x22]
sub eax, dword [rsp + 0xea0]
mov dword [rsp + 0xe98], eax
cmp dword [rsp + 0xe98], 0
je 0x18000bac5
mov eax, dword [rsp + 0xe98]
mov ecx, dword [rsp + 0x858]
sub rcx, 4
cmp rax, rcx
ja 0x18000bac5
mov rax, qword [rsp + 0xea0]
mov eax, dword [rax + 4]
mov dword [0x1802369d0], eax
mov rcx, qword [rsp + 0xeb8]
xor rcx, rsp
call fcn.1800f93c0
add rsp, 0xec0
pop rdi
ret