Function at 0x4078c0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6156e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb40
push ebx
push esi
push edi
call fcn.00406370
push eax
lea ecx, [esp + 0x10]
call fcn.004453e0
xor ebx, ebx
push 0x6752b4
lea ecx, [esp + 0x10]
mov dword [esp + 0xb58], ebx
call fcn.00446890
mov esi, dword [esp + 0xb5c]
cmp esi, ebx
je 0x407916
push str.OAgentS.ini
jmp 0x40791b
push str.OAgent.ini
lea ecx, [esp + 0x10]
call fcn.00446890
mov eax, dword [0x634b24]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x30]
mov byte [esp + 0xb54], 5
call fcn.005e75b5
mov eax, dword [0x634b24]
mov dword [esp + 0x44], eax
mov ecx, 0x8d
xor eax, eax
lea edi, [esp + 0x50]
mov dword [esp + 0x4c], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
push ebx
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x6752a8
push str.AgentConfig
mov byte [esp + 0xb68], 7
call fcn.00479c70
mov eax, dword [esp + 0x20]
push ebx
lea ecx, [esp + 0x34]
push eax
push ecx
push 0x675280
push str.AgentConfig
call fcn.00479c70
mov edx, dword [esp + 0x34]
push ebx
lea eax, [esp + 0x50]
push edx
push eax
push 0x675274
push str.AgentConfig
call fcn.00479c70
mov ecx, dword [esp + 0x48]
push ebx
lea edx, [esp + 0x68]
push ecx
push edx
push str.InstallTime
push str.AgentConfig
call fcn.00479c70
mov eax, dword [esp + 0x5c]
add esp, 0x50
lea ecx, [esp + 0x2c]
push ebx
push eax
push ecx
push 0x67524c
push str.AgentConfig
call fcn.00479c70
mov eax, dword [esp + 0x2c]
add esp, 0x14
cmp dword [eax - 8], ebx
jne 0x407a07
mov dword [esp + 0x4c], ebx
jmp 0x407a17
lea edx, [esp + 0x4c]
push 4
push edx
push eax
call fcn.00459500
add esp, 0xc
mov eax, dword [esp + 0x1c]
cmp dword [eax - 8], ebx
jne 0x407a26
mov dword [esp + 0x50], ebx
jmp 0x407a36
lea ecx, [esp + 0x50]
push 4
push ecx
push eax
call fcn.00459500
add esp, 0xc
mov eax, dword [esp + 0x24]
cmp dword [eax - 8], ebx
jne 0x407a45
mov dword [esp + 0x54], ebx
jmp 0x407a55
lea edx, [esp + 0x54]
push 4
push edx
push eax
call fcn.00459500
add esp, 0xc
mov eax, dword [esp + 0x28]
cmp dword [eax - 8], ebx
jne 0x407a72
push ebx
push ebx
lea eax, [esp + 0x64]
push ebx
push eax
mov ecx, 0x69df20
call fcn.00401537
jmp 0x407a82
lea ecx, [esp + 0x5c]
push 8
push ecx
push eax
call fcn.00459500
add esp, 0xc
mov eax, dword [esp + 0x2c]
cmp dword [eax - 8], ebx
je 0x407a9a
lea edx, [esp + 0x30]
push ebx
push edx
push eax
call fcn.00459680
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.004545b0
cmp esi, ebx
mov byte [esp + 0xb54], 8
push 0x20019
je 0x407abb
push str.SOFTWAREClassesCLSIDAFFAEF68_CDC5_4aad_9D3F_997C0D55927BProgIDS
jmp 0x407ac0
push str.SOFTWAREClassesCLSIDAFFAEF68_CDC5_4aad_9D3F_997C0D55927BProgID
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
call fcn.004546d0
cmp eax, ebx
je 0x407bba
cmp dword [esp + 0x4c], ebx
jne 0x407aef
push ebx
push 0x6752a8
lea ecx, [esp + 0x18]
call fcn.00454870
mov dword [esp + 0x4c], eax
cmp dword [esp + 0x50], ebx
jne 0x407b08
push ebx
push 0x675280
lea ecx, [esp + 0x18]
call fcn.00454870
mov dword [esp + 0x50], eax
cmp dword [esp + 0x54], ebx
jne 0x407b21
push ebx
push 0x675274
lea ecx, [esp + 0x18]
call fcn.00454870
mov dword [esp + 0x54], eax
fld qword [esp + 0x5c]
fcomp qword [0x62e020]
fnstsw ax
test ah, 0x40
je 0x407b47
lea eax, [esp + 0x5c]
push 8
push eax
push str.InstallTime
lea ecx, [esp + 0x1c]
call fcn.004549b0
mov eax, dword [esp + 0x38]
push ebp
cmp eax, ebx
jne 0x407bb0
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], ebx
push ecx
push 0x67524c
lea ecx, [esp + 0x1c]
call fcn.00454af0
mov ebp, eax
cmp ebp, ebx
je 0x407bb0
mov edx, dword [esp + 0x24]
push 0xffffffffffffffff
push edx
lea ecx, [esp + 0x3c]
call fcn.005e7615
mov edi, dword [esp + 0x38]
cmp edi, ebx
je 0x407b9b
mov ecx, dword [esp + 0x24]
mov esi, ebp
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x407ba7
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x3c]
call fcn.005e7615
push ebp
call fcn.005eae89
add esp, 4
lea ecx, [esp + 0x14]
call fcn.00454720
pop ebp
mov eax, dword [esp + 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_GetProfileIntW]
cmp eax, ebx
jne 0x407bd9
push ebx
push 0x6752a8
push str.ED30_8AC4_11D5_8930_A730
call esi
mov dword [esp + 0x4c], eax
cmp dword [esp + 0x50], ebx
jne 0x407bf0
push ebx
push 0x675280
push str.ED30_8AC4_11D5_8930_A730
call esi
mov dword [esp + 0x50], eax
cmp dword [esp + 0x54], ebx
jne 0x407c07
push ebx
push 0x675274
push str.ED30_8AC4_11D5_8930_A730
call esi
mov dword [esp + 0x54], eax
fld qword [esp + 0x5c]
fcomp qword [0x62e020]
mov esi, dword [sym.imp.KERNEL32.dll_GetProfileStringW]
fnstsw ax
test ah, 0x40
je 0x407c97
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x286]
mov word [esp + 0x284], bx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x284]
push 0x64
push ecx
push ebx
push str.InstallTime
push str.ED30_8AC4_11D5_8930_A730
stosw word es:[edi], ax
call esi
cmp eax, ebx
jbe 0x407c74
cmp word [esp + 0x34a], bx
jne 0x407c74
lea edx, [esp + 0x5c]
push 8
lea eax, [esp + 0x288]
push edx
push eax
call fcn.00459500
add esp, 0xc
fld qword [esp + 0x5c]
fcomp qword [0x62e020]
fnstsw ax
test ah, 0x40
je 0x407c97
push ebx
push ebx
lea ecx, [esp + 0x64]
push ebx
push ecx
mov ecx, 0x69df20
call fcn.00401537
cmp dword [esp + 0x38], ebx
jne 0x407cf5
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x34e]
mov word [esp + 0x34c], bx
rep stosd dword es:[edi], eax
lea edx, [esp + 0x34c]
push 0x400
push edx
push ebx
push 0x67524c
push str.ED30_8AC4_11D5_8930_A730
stosw word es:[edi], ax
call esi
cmp eax, ebx
jbe 0x407cf5
cmp word [esp + 0xb4a], bx
jne 0x407cf5
lea eax, [esp + 0x30]
push ebx
lea ecx, [esp + 0x350]
push eax
push ecx
call fcn.00459680
add esp, 0xc
lea edx, [esp + 0x30]
push edx
call fcn.00407f40
add esp, 4
cmp eax, ebx
je 0x407d0e
mov eax, dword [eax + 4]
mov dword [0x674b18], eax
lea ecx, [esp + 0x30]
lea edx, [esp + 0x48]
push ecx
push edx
mov dword [esp + 0x50], ebx
call fcn.00407f90
mov ecx, 0x8e
lea esi, [esp + 0x54]
mov edi, 0x6748e0
add esp, 8
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
mov byte [esp + 0xb54], 7
call fcn.00454650
lea ecx, [esp + 0x44]
mov byte [esp + 0xb54], 6
call fcn.00445c50
lea ecx, [esp + 0x30]
mov byte [esp + 0xb54], 5
call fcn.005e75e8
lea ecx, [esp + 0x2c]
mov byte [esp + 0xb54], 4
call fcn.00445c50
lea ecx, [esp + 0x28]
mov byte [esp + 0xb54], 3
call fcn.00445c50
lea ecx, [esp + 0x24]
mov byte [esp + 0xb54], 2
call fcn.00445c50
lea ecx, [esp + 0x1c]
mov byte [esp + 0xb54], 1
call fcn.00445c50
lea ecx, [esp + 0x18]
mov byte [esp + 0xb54], bl
call fcn.00445c50
lea ecx, [esp + 0xc]
mov dword [esp + 0xb54], 0xffffffff
call fcn.00445c50
mov ecx, dword [esp + 0xb4c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xb4c
ret