Function at 0x417588
Capabilities:
Create directory
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46b680
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x4add60]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
mov eax, dword [0x4add60]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
mov edi, ecx
push str.Downloading_Manifest:
lea ecx, [esp + 0x20]
mov dword [esp + 0x2c], edi
call fcn.004012e2
xor ebx, ebx
push ebx
lea eax, [esp + 0x20]
push eax
push 2
pop esi
push esi
mov dword [esp + 0x254], ebx
call fcn.00410d56
or dword [esp + 0x254], 0xffffffff
mov ecx, dword [esp + 0x28]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004017ba
push str.___URL:
lea ecx, [esp + 0x24]
call fcn.004012e2
lea eax, [edi + 0x10]
push ebx
push eax
mov dword [esp + 0x250], 1
mov dword [esp + 0x24], eax
lea eax, [esp + 0x28]
push eax
push esi
call fcn.00410886
or dword [esp + 0x258], 0xffffffff
mov ecx, dword [esp + 0x30]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004017ba
push str.___file:
lea ecx, [esp + 0x1c]
call fcn.004012e2
mov dword [esp + 0x248], esi
push ebx
lea esi, [edi + 4]
push esi
lea eax, [esp + 0x20]
push eax
push 2
mov dword [esp + 0x30], esi
call fcn.00410886
or dword [esp + 0x258], 0xffffffff
mov ecx, dword [esp + 0x28]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004017ba
push esi
push str.UpdateManifestPath
call fcn.004173a4
test eax, eax
jne 0x4176a5
inc eax
jmp 0x417a1f
call fcn.00416d88
test eax, eax
jne 0x417747
push 0x200
mov word [esp + 0x30], ax
lea eax, [esp + 0x32]
push ebx
push eax
call fcn.0044e740
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x1c], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x417747
lea eax, [esp + 0x2c]
lea ecx, [edi + 8]
push eax
mov dword [esp + 0x1c], ecx
call fcn.00406a25
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
push ebx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov dword [esp + 0x24], eax
cmp eax, 0xa1
je 0x417867
cmp eax, 3
je 0x417867
mov ecx, dword [esp + 0x18]
push 0x5c
call fcn.0041b9fc
push dword [esp + 0x18]
mov ecx, esi
call fcn.00406b64
mov edi, dword [edi + 0x14]
push dword [edi - 0xc]
mov ecx, esi
push edi
call fcn.00401163
call fcn.00416d88
mov edi, dword [esp + 0x1c]
push dword [edi]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
mov eax, dword [0x4b2784]
mov ecx, dword [edi]
neg eax
sbb eax, eax
and eax, 0xfff8ad00
add eax, 0x927c0
push eax
lea eax, [esp + 0x18]
push eax
push ecx
push esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], 1
call fcn.00415922
add esp, 0x10
mov edi, eax
lea eax, [esp + 0x13]
push eax
push dword [esp + 0x18]
mov ecx, 0x4b26d8
push str.BITS_Result
mov byte [esp + 0x1f], bl
call fcn.00406c2e
cmp edi, 6
jne 0x4177e5
push str.BITs_download_success:
lea ecx, [esp + 0x18]
call fcn.004012e2
push ebx
push esi
lea eax, [esp + 0x1c]
push eax
push 2
mov dword [esp + 0x258], 4
call fcn.00410886
or dword [esp + 0x258], 0xffffffff
mov ecx, dword [esp + 0x24]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004017ba
mov esi, dword [esi]
mov ebx, str.2_16_17_18_19_52_53_54_63_68_81_82_83_84_85_86_87_88_89_90_91_92_93_97
or edi, 0xffffffff
call fcn.00420f8b
xor ebx, ebx
cmp eax, ebx
jne 0x4178c5
push str.valid_after_BITs_download:
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], 1
call fcn.004012e2
push ebx
mov dword [esp + 0x24c], 5
push dword [esp + 0x24]
lea eax, [esp + 0x1c]
push eax
push 2
call fcn.00410886
or dword [esp + 0x258], 0xffffffff
mov ecx, dword [esp + 0x24]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004017ba
lea eax, [esp + 0x13]
push eax
push ebx
push str.OK_BITS
push str.Get_Product_Manifest_Result
mov esi, 0x4b26d8
mov byte [esp + 0x23], bl
call fcn.00406bc3
jmp 0x4178de
lea ecx, [esp + 0x13]
push ecx
push eax
push str.Get_Product_Manifest_Result
mov ecx, 0x4b26d8
mov byte [esp + 0x1f], bl
call fcn.00406c2e
push str.SHCreateDirectoryEx___failed:
lea ecx, [esp + 0x20]
call fcn.004012e2
mov dword [esp + 0x248], 3
push dword [esp + 0x24]
lea eax, [esp + 0x20]
push dword [esp + 0x1c]
push eax
push 1
call fcn.00410886
mov ecx, dword [esp + 0x2c]
add esp, 0x10
add ecx, 0xfffffff0
mov esi, eax
call fcn.004017ba
mov eax, esi
jmp 0x417a1f
lea ecx, [esp + 0x13]
push ecx
push eax
push str.Signature_Validation_Error
mov ecx, 0x4b26d8
mov byte [esp + 0x1f], bl
call fcn.00406c2e
cmp dword [0x4b2798], ebx
je 0x4178ed
xor eax, eax
jmp 0x417a1f
cmp dword [esp + 0x18], ebx
jne 0x417a1b
call fcn.0043ce9a
push eax
lea ecx, [esp + 0x28]
call fcn.00413a25
push 0x475f40
lea ecx, [esp + 0x18]
mov dword [esp + 0x24c], 6
call fcn.004012e2
lea edi, [esp + 0x24]
lea ecx, [esp + 0x14]
mov esi, 0x4b26d8
mov byte [esp + 0x248], 7
call fcn.00409ce0
mov byte [esp + 0x248], 6
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004017ba
mov edx, edi
call fcn.004095b0
mov esi, dword [esp + 0x20]
push 1
push ebx
push ebx
push ebx
push dword [esp + 0x2c]
push esi
push dword [esp + 0x40]
call fcn.004198ae
mov dword [esp + 0x18], eax
cmp eax, ebx
je 0x417a43
mov esi, dword [esi]
mov ebx, str.2_16_17_18_19_52_53_54_63_68_81_82_83_84_85_86_87_88_89_90_91_92_93_97
or edi, 0xffffffff
call fcn.00420f8b
mov esi, eax
test esi, esi
je 0x4179e9
and dword [esp + 0x18], 0
lea eax, [esp + 0x13]
push eax
push esi
push str.Signature_Validation_Error
mov ecx, 0x4b26d8
mov byte [esp + 0x1f], 0
call fcn.00406c2e
push str.invalid_after_BB_download:
lea ecx, [esp + 0x18]
call fcn.004012e2
push esi
mov byte [esp + 0x24c], 8
push dword [esp + 0x24]
lea eax, [esp + 0x1c]
push eax
push 1
call fcn.00410886
mov byte [esp + 0x258], 6
mov ecx, dword [esp + 0x24]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004017ba
xor ebx, ebx
cmp dword [esp + 0x18], ebx
je 0x417a0f
lea eax, [esp + 0x13]
push eax
push ebx
push str.OK_BB
push str.Get_Product_Manifest_Result
mov esi, 0x4b26d8
mov byte [esp + 0x23], bl
call fcn.00406bc3
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.004017ba
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.0044da13
mov esp, ebp
pop ebp
ret
push str.BB_download_failed:
lea ecx, [esp + 0x18]
call fcn.004012e2
push ebx
mov byte [esp + 0x24c], 9
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
push 1
call fcn.00410886
mov byte [esp + 0x258], 6
mov ecx, dword [esp + 0x24]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004017ba
jmp 0x4179eb