Function at 0x47db98
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x531827
mov eax, dword fs:[0]
push eax
sub esp, 0x128
push ebx
push esi
push edi
mov eax, dword [0x597790]
xor eax, esp
push eax
lea eax, [esp + 0x138]
mov dword fs:[0], eax
mov edi, ecx
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Running_YDetect_in_InstallIQProcess__elevated_
call fcn.00401769
and dword [esp + 0x144], 0
or esi, 0xffffffff
push 4
mov dword [esp + 0x148], esi
call fcn.0041485d
push ecx
lea ebx, [edi + 0x24]
mov ecx, esp
mov dword [esp + 0x18], esp
push ebx
call fcn.0040184e
mov dword [esp + 0x144], 1
mov dword [esp + 0x144], esi
mov ecx, dword [edi + 0x3c]
call fcn.00496115
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
test eax, eax
jne 0x47dc96
push str.CIQYDetect::RunYDetectInDaemon
call fcn.00401769
mov dword [esp + 0x144], 2
push 0x107
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str..IQYDetect.cpp
call fcn.00401769
mov byte [esp + 0x14c], 3
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.Failed_to_initialize_pipe_from_installer_
call fcn.00401769
mov byte [esp + 0x150], 4
mov edi, dword [edi + 0x3c]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov eax, dword [eax + 8]
push eax
mov dword [esp + 0x154], esi
call fcn.00411585
jmp 0x47dee0
push str.runfile
call fcn.00401769
mov dword [esp + 0x144], 5
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x148], esi
call fcn.00496e9a
mov dword [esp + 0x140], 6
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.ydetect
call fcn.00401769
mov byte [esp + 0x144], 7
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x553ea4
call fcn.00401769
mov byte [esp + 0x148], 8
mov byte [esp + 0x148], 6
lea esi, [esp + 0x3c]
call fcn.0047c9f8
push ecx
lea eax, [edi + 0x30]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0040184e
mov byte [esp + 0x144], 9
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push ebx
call fcn.0040184e
mov byte [esp + 0x148], 0xa
mov byte [esp + 0x148], 6
lea esi, [esp + 0x2c]
call fcn.004139f3
mov byte [esp + 0x148], 0xb
add esp, 4
mov eax, esi
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0040184e
mov byte [esp + 0x144], 0xc
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.filename
call fcn.00401769
mov byte [esp + 0x148], 0xd
mov byte [esp + 0x148], 0xb
lea esi, [esp + 0x3c]
call fcn.0047c9f8
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.processintegrity
call fcn.00401769
mov byte [esp + 0x148], 0xe
mov byte [esp + 0x148], 0xb
call fcn.0047ca65
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x53e9ff
call fcn.00401769
mov byte [esp + 0x144], 0xf
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.commandline
call fcn.00401769
mov byte [esp + 0x148], 0x10
mov byte [esp + 0x148], 0xb
call fcn.0047c9f8
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push eax
mov ecx, esi
call fcn.0047ccee
mov byte [esp + 0x144], 0x11
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.cmd.runfile.ydetect.xml
call fcn.00401769
mov byte [esp + 0x148], 0x12
mov byte [esp + 0x148], 0xb
mov ebx, dword [edi + 0x3c]
call fcn.0047cd1e
xor esi, esi
cmp eax, esi
jne 0x47def8
mov ecx, dword [edi + 0x3c]
mov esi, dword [edi]
mov eax, dword [ecx]
add esi, 0x28
call dword [eax + 8]
push eax
mov ecx, edi
call dword [esi]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CIQYDetect::RunYDetectInDaemon
call fcn.00401769
mov byte [esp + 0x144], 0x13
push 0x114
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str..IQYDetect.cpp
call fcn.00401769
mov byte [esp + 0x14c], 0x14
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.Failed_to_send_runfile_command_to_installer_for_YDetect
call fcn.00401769
mov byte [esp + 0x150], 0x15
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov eax, dword [eax + 8]
push eax
mov byte [esp + 0x154], 0xb
call fcn.00411585
mov byte [esp + 0x140], 6
lea ecx, [esp + 0x24]
call fcn.00401898
or dword [esp + 0x140], 0xffffffff
lea ecx, [esp + 0x34]
call fcn.00496f86
xor eax, eax
mov ecx, dword [esp + 0x138]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x20], esi
mov dword [esp + 0x2c], esi
cmp dword [esp + 0x20], esi
jne 0x47e17b
lea ecx, [esp + 0x28]
call fcn.00404433
mov byte [esp + 0x140], 0x16
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.runfile.ydetect
call fcn.00401769
mov byte [esp + 0x148], 0x17
lea eax, [esp + 0x30]
push eax
push dword [edi + 0x3c]
mov byte [esp + 0x150], 0x16
call fcn.0047cecb
cmp eax, esi
je 0x47e146
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0040184e
mov byte [esp + 0x144], 0x18
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x148], 0x16
call fcn.00496e9a
mov byte [esp + 0x140], 0x19
lea eax, [esp + 0x18]
push eax
lea esi, [esp + 0xb8]
call fcn.0047cc6a
mov byte [esp + 0x140], 0x1a
push str.runfile
mov ecx, eax
call fcn.0040412c
test eax, eax
setne bl
mov byte [esp + 0x140], 0x19
lea ecx, [esp + 0x18]
call fcn.00401898
test bl, bl
je 0x47dfe2
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Command_result__runfile.ydetect__recieved__but_not_recognized_as_command
call fcn.00401769
mov byte [esp + 0x144], 0x1b
jmp 0x47e05b
push str.ydetect
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x553ea4
call fcn.00401769
mov byte [esp + 0x148], 0x1c
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x14c], 0x19
lea esi, [esp + 0xc0]
call fcn.0047cab0
mov byte [esp + 0x144], 0x1d
mov ecx, eax
call fcn.0040412c
test eax, eax
setne bl
mov byte [esp + 0x140], 0x19
lea ecx, [esp + 0x14]
call fcn.00401898
test bl, bl
je 0x47e06f
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Command_result__runfile.ydetect__recieved__but_name_did_not_match
call fcn.00401769
mov byte [esp + 0x144], 0x1e
push 1
mov byte [esp + 0x148], 0x19
call fcn.0041485d
jmp 0x47e12e
lea ecx, [esp + 0x30]
call fcn.00404433
mov byte [esp + 0x140], 0x1f
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.exitcode
call fcn.00401769
mov byte [esp + 0x144], 0x20
mov byte [esp + 0x144], 0x1f
lea ecx, [esp + 0xb8]
call fcn.0047cbe0
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.executesucceeded
call fcn.00401769
mov byte [esp + 0x148], 0x21
mov byte [esp + 0x148], 0x1f
lea ecx, [esp + 0xbc]
call fcn.0047cb56
push eax
lea eax, [esp + 0x38]
push str.YDetect_results_received__executeSucceeded_d__exitcode_d
push eax
call fcn.00404420
add esp, 0xc
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0040184e
mov byte [esp + 0x144], 0x22
push 2
mov byte [esp + 0x148], 0x1f
call fcn.0041485d
mov dword [esp + 0x20], 1
mov byte [esp + 0x140], 0x19
lea ecx, [esp + 0x30]
call fcn.00401898
mov byte [esp + 0x140], 0x16
lea ecx, [esp + 0xb4]
call fcn.00496f86
xor esi, esi
jmp 0x47e151
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esp + 0x140], 0xb
lea ecx, [esp + 0x28]
call fcn.00401898
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 0x4b
jl 0x47df00
cmp dword [esp + 0x20], esi
je 0x47debe
mov ecx, edi
call fcn.0047d67f
test eax, eax
je 0x47debe
xor esi, esi
lea eax, [esp + 0x14]
inc esi
push eax
mov ecx, edi
mov dword [edi + 0x2c], esi
call fcn.0047d5a9
mov byte [esp + 0x140], 0x23
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
push str.YDetect_results
push ecx
call fcn.00404236
add esp, 0xc
mov byte [esp + 0x144], 0x24
push 2
mov byte [esp + 0x148], 0x23
call fcn.0041485d
mov byte [esp + 0x140], 0xb
lea ecx, [esp + 0x14]
call fcn.00401898
mov byte [esp + 0x140], 6
lea ecx, [esp + 0x24]
call fcn.00401898
or dword [esp + 0x140], 0xffffffff
lea ecx, [esp + 0x34]
call fcn.00496f86
mov eax, esi
jmp 0x47dee2