Function at 0x4079d0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x619803
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb40
push ebx
push esi
push edi
call fcn.00406480
push eax
lea ecx, [esp + 0x10]
call fcn.00445810
xor ebx, ebx
push 0x67a29c
lea ecx, [esp + 0x10]
mov dword [esp + 0xb58], ebx
call fcn.00446cc0
mov esi, dword [esp + 0xb5c]
cmp esi, ebx
je 0x407a26
push str.OAgentS.ini
jmp 0x407a2b
push str.OAgent.ini
lea ecx, [esp + 0x10]
call fcn.00446cc0
mov eax, dword [0x638b24]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x30]
mov byte [esp + 0xb54], 5
call fcn.005eb6bd
mov eax, dword [0x638b24]
mov dword [esp + 0x44], eax
mov ecx, 0x8d
xor eax, eax
lea edi, [esp + 0x50]
mov dword [esp + 0x4c], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
push ebx
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x67a290
push str.AgentConfig
mov byte [esp + 0xb68], 7
call fcn.0047a0a0
mov eax, dword [esp + 0x20]
push ebx
lea ecx, [esp + 0x34]
push eax
push ecx
push 0x67a268
push str.AgentConfig
call fcn.0047a0a0
mov edx, dword [esp + 0x34]
push ebx
lea eax, [esp + 0x50]
push edx
push eax
push 0x67a25c
push str.AgentConfig
call fcn.0047a0a0
mov ecx, dword [esp + 0x48]
push ebx
lea edx, [esp + 0x68]
push ecx
push edx
push str.InstallTime
push str.AgentConfig
call fcn.0047a0a0
mov eax, dword [esp + 0x5c]
add esp, 0x50
lea ecx, [esp + 0x2c]
push ebx
push eax
push ecx
push 0x67a234
push str.AgentConfig
call fcn.0047a0a0
mov eax, dword [esp + 0x2c]
add esp, 0x14
cmp dword [eax - 8], ebx
jne 0x407b17
mov dword [esp + 0x4c], ebx
jmp 0x407b27
lea edx, [esp + 0x4c]
push 4
push edx
push eax
call fcn.00459930
add esp, 0xc
mov eax, dword [esp + 0x1c]
cmp dword [eax - 8], ebx
jne 0x407b36
mov dword [esp + 0x50], ebx
jmp 0x407b46
lea ecx, [esp + 0x50]
push 4
push ecx
push eax
call fcn.00459930
add esp, 0xc
mov eax, dword [esp + 0x24]
cmp dword [eax - 8], ebx
jne 0x407b55
mov dword [esp + 0x54], ebx
jmp 0x407b65
lea edx, [esp + 0x54]
push 4
push edx
push eax
call fcn.00459930
add esp, 0xc
mov eax, dword [esp + 0x28]
cmp dword [eax - 8], ebx
jne 0x407b82
push ebx
push ebx
lea eax, [esp + 0x64]
push ebx
push eax
mov ecx, 0x6a3100
call fcn.0040152d
jmp 0x407b92
lea ecx, [esp + 0x5c]
push 8
push ecx
push eax
call fcn.00459930
add esp, 0xc
mov eax, dword [esp + 0x2c]
cmp dword [eax - 8], ebx
je 0x407baa
lea edx, [esp + 0x30]
push ebx
push edx
push eax
call fcn.00459ab0
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.004549e0
cmp esi, ebx
mov byte [esp + 0xb54], 8
push 0x20019
je 0x407bcb
push str.SOFTWAREClassesCLSIDAFFAEF68_CDC5_4aad_9D3F_997C0D55927BProgIDS
jmp 0x407bd0
push str.SOFTWAREClassesCLSIDAFFAEF68_CDC5_4aad_9D3F_997C0D55927BProgID
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
call fcn.00454b00
cmp eax, ebx
je 0x407cca
cmp dword [esp + 0x4c], ebx
jne 0x407bff
push ebx
push 0x67a290
lea ecx, [esp + 0x18]
call fcn.00454ca0
mov dword [esp + 0x4c], eax
cmp dword [esp + 0x50], ebx
jne 0x407c18
push ebx
push 0x67a268
lea ecx, [esp + 0x18]
call fcn.00454ca0
mov dword [esp + 0x50], eax
cmp dword [esp + 0x54], ebx
jne 0x407c31
push ebx
push 0x67a25c
lea ecx, [esp + 0x18]
call fcn.00454ca0
mov dword [esp + 0x54], eax
fld qword [esp + 0x5c]
fcomp qword [0x632020]
fnstsw ax
test ah, 0x40
je 0x407c57
lea eax, [esp + 0x5c]
push 8
push eax
push str.InstallTime
lea ecx, [esp + 0x1c]
call fcn.00454de0
mov eax, dword [esp + 0x38]
push ebp
cmp eax, ebx
jne 0x407cc0
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], ebx
push ecx
push 0x67a234
lea ecx, [esp + 0x1c]
call fcn.00454f20
mov ebp, eax
cmp ebp, ebx
je 0x407cc0
mov edx, dword [esp + 0x24]
push 0xffffffffffffffff
push edx
lea ecx, [esp + 0x3c]
call fcn.005eb71d
mov edi, dword [esp + 0x38]
cmp edi, ebx
je 0x407cab
mov ecx, dword [esp + 0x24]
mov esi, ebp
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x407cb7
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x3c]
call fcn.005eb71d
push ebp
call fcn.005eef91
add esp, 4
lea ecx, [esp + 0x14]
call fcn.00454b50
pop ebp
mov eax, dword [esp + 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_GetProfileIntW]
cmp eax, ebx
jne 0x407ce9
push ebx
push 0x67a290
push str.ED30_8AC4_11D5_8930_A730
call esi
mov dword [esp + 0x4c], eax
cmp dword [esp + 0x50], ebx
jne 0x407d00
push ebx
push 0x67a268
push str.ED30_8AC4_11D5_8930_A730
call esi
mov dword [esp + 0x50], eax
cmp dword [esp + 0x54], ebx
jne 0x407d17
push ebx
push 0x67a25c
push str.ED30_8AC4_11D5_8930_A730
call esi
mov dword [esp + 0x54], eax
fld qword [esp + 0x5c]
fcomp qword [0x632020]
mov esi, dword [sym.imp.KERNEL32.dll_GetProfileStringW]
fnstsw ax
test ah, 0x40
je 0x407da7
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x286]
mov word [esp + 0x284], bx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x284]
push 0x64
push ecx
push ebx
push str.InstallTime
push str.ED30_8AC4_11D5_8930_A730
stosw word es:[edi], ax
call esi
cmp eax, ebx
jbe 0x407d84
cmp word [esp + 0x34a], bx
jne 0x407d84
lea edx, [esp + 0x5c]
push 8
lea eax, [esp + 0x288]
push edx
push eax
call fcn.00459930
add esp, 0xc
fld qword [esp + 0x5c]
fcomp qword [0x632020]
fnstsw ax
test ah, 0x40
je 0x407da7
push ebx
push ebx
lea ecx, [esp + 0x64]
push ebx
push ecx
mov ecx, 0x6a3100
call fcn.0040152d
cmp dword [esp + 0x38], ebx
jne 0x407e05
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x34e]
mov word [esp + 0x34c], bx
rep stosd dword es:[edi], eax
lea edx, [esp + 0x34c]
push 0x400
push edx
push ebx
push 0x67a234
push str.ED30_8AC4_11D5_8930_A730
stosw word es:[edi], ax
call esi
cmp eax, ebx
jbe 0x407e05
cmp word [esp + 0xb4a], bx
jne 0x407e05
lea eax, [esp + 0x30]
push ebx
lea ecx, [esp + 0x350]
push eax
push ecx
call fcn.00459ab0
add esp, 0xc
lea edx, [esp + 0x30]
push edx
call fcn.00408050
add esp, 4
cmp eax, ebx
je 0x407e1e
mov eax, dword [eax + 4]
mov dword [0x679b00], eax
lea ecx, [esp + 0x30]
lea edx, [esp + 0x48]
push ecx
push edx
mov dword [esp + 0x50], ebx
call fcn.004080a0
mov ecx, 0x8e
lea esi, [esp + 0x54]
mov edi, 0x6798c8
add esp, 8
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
mov byte [esp + 0xb54], 7
call fcn.00454a80
lea ecx, [esp + 0x44]
mov byte [esp + 0xb54], 6
call fcn.00446080
lea ecx, [esp + 0x30]
mov byte [esp + 0xb54], 5
call fcn.005eb6f0
lea ecx, [esp + 0x2c]
mov byte [esp + 0xb54], 4
call fcn.00446080
lea ecx, [esp + 0x28]
mov byte [esp + 0xb54], 3
call fcn.00446080
lea ecx, [esp + 0x24]
mov byte [esp + 0xb54], 2
call fcn.00446080
lea ecx, [esp + 0x1c]
mov byte [esp + 0xb54], 1
call fcn.00446080
lea ecx, [esp + 0x18]
mov byte [esp + 0xb54], bl
call fcn.00446080
lea ecx, [esp + 0xc]
mov dword [esp + 0xb54], 0xffffffff
call fcn.00446080
mov ecx, dword [esp + 0xb4c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xb4c
ret