Function at 0x40ab70
Capabilities:
Check for time delay via gettickcount
Check os version
Create process on windows
Create process suspended
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x507529
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4a4
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0x556998
lea ecx, [esp + 0x14]
call fcn.004ea7b5
mov ebp, dword [esp + 0x4c8]
xor ebx, ebx
push ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4c0], ebx
call fcn.004ea7b5
mov eax, dword [eax]
lea ecx, [esp + 0x10]
push eax
push str.Run_Process:_run_start...___s_..._r_nRun_Process:_Step1...
push ecx
mov byte [esp + 0x4c8], 1
call fcn.004e3c81
add esp, 0xc
lea ecx, [esp + 0x18]
mov byte [esp + 0x4bc], bl
call fcn.004ea741
mov edx, dword [esp + 0x10]
push ebx
push 2
push edx
call fcn.0041e3a0
add esp, 0xc
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
push eax
push str._I64u
push ebp
call fcn.00435574
add esp, 0xc
lea ecx, [esp + 0x10]
push str.Step2...
push ecx
call fcn.004e3c81
mov edx, dword [esp + 0x18]
push ebx
push 2
push edx
call fcn.0041e3a0
mov eax, dword [esp + 0x4d8]
add esp, 0x14
lea ecx, [esp + 0x18]
push eax
call fcn.004ea7b5
mov eax, dword [eax]
lea ecx, [esp + 0x20]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x4c4], 2
call fcn.0040ba10
lea ecx, [esp + 0x18]
mov byte [esp + 0x4bc], 4
call fcn.004ea741
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x28]
push edx
call fcn.00454fb0
lea eax, [esp + 0x10]
push str.Step3...
push eax
mov byte [esp + 0x4c4], 5
call fcn.004e3c81
mov ecx, dword [esp + 0x18]
push ebx
push 2
push ecx
call fcn.0041e3a0
mov eax, dword [esi + 0x38]
xor edx, edx
mov dword [esp + 0x4c], edx
add esp, 0x14
mov dword [esp + 0x3c], edx
cmp eax, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x40], edx
je 0x40ad42
lea eax, [esp + 0x10]
push str.Step4A...
push eax
call fcn.004e3c81
mov ecx, dword [esp + 0x18]
push ebx
push 2
push ecx
call fcn.0041e3a0
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x78]
add esp, 0x14
mov dword [esp + 0x60], 0x44
lea edx, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push edx
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x64]
push eax
push ecx
push ebx
push ebx
push ebx
push edx
push ebx
push ebx
lea ecx, [esi + 0x34]
call fcn.00404bc0
mov edi, eax
call fcn.0047a5d0
test eax, eax
jne 0x40ad29
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push str.Step4B...
push eax
call fcn.004e3c81
mov ecx, dword [esp + 0x18]
push ebx
push 2
push ecx
jmp 0x40adb5
lea edx, [esp + 0x10]
push str.Step5A...
push edx
call fcn.004e3c81
mov eax, dword [esp + 0x18]
push ebx
push 2
push eax
call fcn.0041e3a0
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x78]
mov dword [esp + 0x74], 0x44
rep stosd dword es:[edi], eax
add esp, 0x14
lea ecx, [esp + 0x34]
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x60]
push ecx
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x10]
push str.Step5B...
push ecx
mov dword [esp + 0x24], eax
call fcn.004e3c81
mov edx, dword [esp + 0x18]
push ebx
push 2
push edx
call fcn.0041e3a0
add esp, 0x14
lea eax, [esp + 0x10]
push str.Step6...
push eax
call fcn.004e3c81
mov ecx, dword [esp + 0x18]
push ebx
push 2
push ecx
call fcn.0041e3a0
add esp, 0x14
cmp edi, ebx
jne 0x40b08a
cmp dword [esp + 0x1c], 5
jne 0x40b026
lea edx, [esp + 0x10]
push str.Step7A_Install_LInstSvr...
push edx
call fcn.004e3c81
mov eax, dword [esp + 0x18]
push ebx
push 2
push eax
call fcn.0041e3a0
add esp, 0x14
mov ecx, esi
call fcn.00410050
test eax, eax
je 0x40b026
lea ecx, [esp + 0x18]
push str._win_LInstSvr.exe
push ecx
mov ecx, esi
call fcn.0040ba10
mov byte [esp + 0x4bc], 6
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0xa6]
mov word [esp + 0xa4], bx
mov edx, dword [esp + 0x30]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x20]
push edx
stosw word es:[edi], ax
mov eax, dword [esp + 0x30]
lea edx, [esp + 0xa8]
push eax
push ecx
push str._s__d
push edx
call fcn.004355aa
add esp, 0x14
lea eax, [esp + 0xa4]
mov dword [esi + 0x110], 1
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.OAgent_Install_Helper_Service_V3
call fcn.004ea7b5
push ecx
mov byte [esp + 0x4c8], 7
mov ecx, esp
mov dword [esp + 0x30], esp
push str.LInstSv3
call fcn.004ea7b5
push ecx
mov byte [esp + 0x4cc], 8
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.004ea4ae
mov ecx, esi
mov byte [esp + 0x4cc], 6
call fcn.0040fd70
cmp eax, ebx
je 0x40b015
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x48]
mov dword [esp + 0x44], ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x44]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.LInstSv3
call fcn.004ea7b5
mov ecx, esi
mov byte [esp + 0x4c4], 6
call fcn.00410530
cmp eax, ebx
je 0x40af3e
cmp dword [esp + 0x48], 1
je 0x40af8b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, ebp
jb 0x40af55
sub eax, ebp
cmp eax, 0x493e0
ja 0x40af55
jmp 0x40aef9
lea ecx, [esp + 0x14]
push 0x52b250
push ecx
mov dword [esp + 0x1c], 0xffff
call fcn.0043553a
lea edx, [esp + 0x10]
push str.Wait_for_the_service_to_stop_timeout...
push edx
call fcn.004e3c81
mov eax, dword [esp + 0x18]
push ebx
push 1
push eax
call fcn.0041e3a0
add esp, 0x14
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0xffff
push 0x52b250
push ecx
call fcn.0043553a
lea ecx, [esi + 0xf8]
call fcn.00464670
cmp eax, ebx
jne 0x40afd0
lea edx, [esp + 0x10]
push str.The_share_memory_is_null...
push edx
call fcn.004e3c81
mov eax, dword [esp + 0x18]
push ebx
push 1
push eax
call fcn.0041e3a0
add esp, 0x14
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0xffff
push 0x52b250
push ecx
call fcn.0043553a
cmp dword [eax], 2
jne 0x40afeb
lea ecx, [esp + 0x18]
mov byte [esp + 0x4bc], 5
call fcn.004ea741
jmp 0x40b0df
add eax, 4
lea edx, [esp + 0x10]
push eax
push 0x54029c
push edx
call fcn.004e3c81
mov eax, dword [esp + 0x1c]
push ebx
push 1
push eax
call fcn.0041e3a0
mov ebp, dword [esp + 0x4e0]
add esp, 0x18
lea ecx, [esp + 0x18]
mov byte [esp + 0x4bc], 5
call fcn.004ea741
push ebp
lea ecx, [esp + 0x18]
call fcn.004ea7b5
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x18]
push str.Run_Process:_Create_Process_failed____s___LastError:_d_n
push eax
mov byte [esp + 0x4cc], 0xb
call fcn.004e3c81
add esp, 0x10
lea ecx, [esp + 0x14]
mov byte [esp + 0x4bc], 5
call fcn.004ea741
mov ecx, dword [esp + 0x10]
push ebx
push 1
push ecx
call fcn.0041e3a0
add esp, 0xc
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 0xc
push 0x52b250
push edx
call fcn.0043553a
mov eax, dword [esp + 0x2c]
and eax, 2
or eax, ebx
je 0x40b0df
mov eax, dword [esp + 0x34]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40b0c0
lea ecx, [esp + 0x14]
push 0x52b250
push ecx
mov dword [esp + 0x1c], 0xd
call fcn.0043553a
lea edx, [esp + 0x10]
push str.Step7...
push edx
call fcn.004e3c81
mov eax, dword [esp + 0x18]
push ebx
push 2
push eax
call fcn.0041e3a0
add esp, 0x14
lea ecx, [esp + 0x10]
push str.Step_end__r_n
push ecx
call fcn.004e3c81
mov edx, dword [esp + 0x18]
push ebx
push 2
push edx
call fcn.0041e3a0
mov eax, dword [esp + 0x48]
add esp, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x28]
mov byte [esp + 0x4bc], 4
call fcn.00455820
lea ecx, [esp + 0x20]
mov byte [esp + 0x4bc], bl
call fcn.004ea741
lea ecx, [esp + 0x10]
mov dword [esp + 0x4bc], 0xffffffff
call fcn.004ea741
mov ecx, dword [esp + 0x4b4]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x4b0
ret 8