Function at 0x47f570
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a398d
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x639354]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, 0x1b
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push str.wps.exe
push esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], eax
call fcn.0056b422
add esp, 8
test eax, eax
je 0x47f6d8
push str.ksolaunch.exe
push esi
call fcn.0056b422
add esp, 8
test eax, eax
je 0x47f6d8
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.wps.exe
push esi
call ebx
cmp eax, esi
jne 0x47f5f4
xor edi, edi
jmp 0x47fa5e
push str.et.exe
push esi
call ebx
cmp eax, esi
jne 0x47f60a
mov edi, 2
jmp 0x47fa5e
push str.wpp.exe
push esi
call ebx
cmp eax, esi
jne 0x47f620
mov edi, 1
jmp 0x47fa5e
push str.launcher.exe
push esi
call ebx
cmp eax, esi
jne 0x47f636
mov edi, 0xf
jmp 0x47fa5e
push str.wpsoffice.exe
push esi
call ebx
cmp eax, esi
jne 0x47f64c
mov edi, 0x15
jmp 0x47fa5e
push 0x5c22c0
push esi
call ebx
cmp eax, esi
jne 0x47fa5e
mov ecx, 0x641e28
call fcn.00496c50
test eax, eax
je 0x47f6ce
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2c]
call fcn.004445b0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
call fcn.00448aa0
lea eax, [ebp - 0x2c]
push eax
call fcn.00448aa0
lea eax, [ebp - 0x2c]
push eax
call fcn.00448aa0
lea eax, [ebp - 0x34]
push eax
call fcn.0047d6e0
lea ecx, [ebp - 0x2c]
push ecx
push eax
call fcn.00438ec0
add esp, 0x18
lea ecx, [ebp - 0x34]
mov bl, al
call fcn.004296c0
test bl, bl
lea ecx, [ebp - 0x2c]
mov eax, 3
cmovne edi, eax
call fcn.004296c0
jmp 0x47fa5e
mov edi, 3
jmp 0x47fa5e
push str.wps.exe
push esi
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x47f70f
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str._w__from
push ebx
call esi
cmp eax, ebx
je 0x47f708
push str._from
push ebx
call esi
cmp eax, ebx
jne 0x47f70f
xor eax, eax
jmp 0x47fa60
xor ebx, ebx
xor eax, eax
xor esi, esi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], 1
test eax, eax
jne 0x47f742
xor edi, edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x3c], edi
jmp 0x47f882
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], 0
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x47f76a
xor ebx, ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], ebx
xor esi, esi
jmp 0x47f87f
xor edi, edi
cmp dword [ebp - 0x48], edi
je 0x47f875
xor ebx, ebx
mov edx, dword [eax + edi*4]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x28], 0
mov word [ebp - 0x28], ax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
lea eax, [ecx + 2]
mov dword [ebp - 0x38], eax
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47f7a0
sub ecx, dword [ebp - 0x38]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0042e330
mov byte [ebp - 4], 2
cmp esi, ebx
je 0x47f80c
mov eax, dword [ebp - 0x28]
mov edx, 7
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x14], eax
xor eax, eax
add esi, 0x18
mov word [ebp - 0x28], ax
mov dword [ebp - 0x40], esi
jmp 0x47f827
lea eax, [ebp - 0x28]
push eax
push esi
lea ecx, [ebp - 0x44]
call fcn.0043ef50
mov eax, dword [ebp - 0x3c]
mov ebx, eax
mov esi, dword [ebp - 0x40]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 1
cmp edx, 8
jb 0x47f862
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47f858
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47fa7c
push edx
push ecx
call fcn.0055c524
add esp, 8
mov eax, dword [ebp - 0x30]
inc edi
cmp edi, dword [ebp - 0x48]
jne 0x47f777
mov ebx, dword [ebp - 0x44]
mov dword [ebp - 0x38], ebx
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], esi
push 0x5bf658
push esi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 3
push ebx
push eax
call fcn.00477970
add esp, 0x10
cmp esi, dword [eax]
je 0x47f8ad
xor edi, edi
jmp 0x47f9e5
mov edi, ebx
cmp edi, esi
je 0x47f8de
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x47f8bd
mov eax, dword [edi]
cmp dword [edi + 0x10], 3
jne 0x47f8d7
push 3
push 0x5bf670
push eax
call fcn.00449d70
add esp, 0xc
test eax, eax
je 0x47f8ff
add edi, 0x18
cmp edi, esi
jne 0x47f8b3
push 0x5bf680
push esi
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.00477970
add esp, 0x10
cmp esi, dword [eax]
je 0x47f90d
mov edi, 1
jmp 0x47f9e5
cmp esi, edi
je 0x47f8de
mov edi, 2
jmp 0x47f9e5
push 0x5bf698
push esi
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.00477970
add esp, 0x10
cmp esi, dword [eax]
je 0x47f978
push dword [ebp - 0x34]
lea ecx, [ebp - 0x30]
call fcn.004445b0
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 4
push eax
call fcn.00448aa0
lea eax, [ebp - 0x34]
push eax
call fcn.0047d6e0
lea ecx, [ebp - 0x30]
push ecx
push eax
call fcn.00438ec0
add esp, 0x10
lea ecx, [ebp - 0x34]
mov bl, al
call fcn.004296c0
test bl, bl
lea ecx, [ebp - 0x30]
mov eax, 3
mov edi, 0x1b
cmovne edi, eax
call fcn.004296c0
mov ebx, dword [ebp - 0x38]
jmp 0x47f9e5
mov edi, ebx
cmp edi, esi
je 0x47f9af
mov edi, edi
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x47f98a
mov eax, dword [edi]
cmp dword [edi + 0x10], 0x20
jne 0x47f9a8
push 0x20
push str._prometheus__newFromJumplistpdf
push eax
call fcn.00449d70
add esp, 0xc
test eax, eax
je 0x47fa2f
add edi, 0x18
cmp edi, esi
jne 0x47f980
mov edi, ebx
cmp edi, esi
je 0x47f9e0
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x47f9bf
mov eax, dword [edi]
cmp dword [edi + 0x10], 0xb
jne 0x47f9d9
push 0xb
push 0x5bf628
push eax
call fcn.00449d70
add esp, 0xc
test eax, eax
je 0x47fa3e
add edi, 0x18
cmp edi, esi
jne 0x47f9b5
mov edi, 0x1b
test ebx, ebx
je 0x47fa5e
lea eax, [ebp - 0x44]
push eax
push esi
push ebx
call fcn.0043eee0
mov ecx, dword [ebp - 0x2c]
mov eax, 0x2aaaaaab
sub ecx, ebx
add esp, 0xc
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, ebx
shl ecx, 3
cmp ecx, 0x1000
jb 0x47fa54
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47fa7c
jmp 0x47fa54
cmp esi, edi
je 0x47f9af
mov edi, 3
jmp 0x47f9e5
cmp esi, edi
mov dword [ebp - 0x34], 0x1b
mov edi, dword [ebp - 0x34]
mov eax, 0x15
cmovne edi, eax
jmp 0x47f9e5
push ecx
push ebx
call fcn.0055c524
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055c3a9
mov esp, ebp
pop ebp
ret
call fcn.0056af64
int3