Function at 0x4670e8
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, ecx
xor ecx, ecx
mov dword [ebp - 8], edx
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [ebx]
or dword [esi + 0x1c], 0xffffffff
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x30], 0xa7
mov dword [ebp - 0x18], ecx
test edx, edx
je 0x4671ab
test byte [edi + 0x18], 6
je 0x467138
mov edx, ecx
mov dword [ebp - 8], edx
jmp 0x4671ab
mov edi, ecx
cmp dword [eax + 0x14], ecx
jle 0x46717f
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x3c], eax
mov ecx, dword [eax]
call fcn.00441c65
test eax, eax
je 0x467169
mov ecx, dword [ebp - 0x10]
inc edi
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 8]
add eax, 0x10
mov dword [ebp - 0x3c], eax
cmp edi, dword [ecx + 0x14]
jl 0x467145
mov eax, ecx
jmp 0x46717f
mov edx, dword [ebp - 0x10]
mov eax, edi
add eax, eax
mov ecx, dword [edx + 0x10]
mov eax, dword [ecx + eax*8 + 0xc]
mov dword [ebp - 0x24], eax
mov eax, edx
mov edx, dword [ebp - 8]
cmp edi, dword [eax + 0x14]
jne 0x4671a5
mov ecx, str.main
call fcn.00441c65
mov edi, dword [ebp + 0x10]
test eax, eax
jne 0x4671a8
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax]
mov dword [ebp - 0x24], ecx
jmp 0x467133
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [edi + 4]
mov dword [ebp - 0x48], eax
test eax, eax
je 0x4672fe
xor ecx, ecx
lea edi, [eax + 8]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], edi
cmp dword [eax], ecx
jle 0x4672cd
test dword [edi + 0x28], 0x2000
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x2c], eax
je 0x4673d7
and dword [ebp - 0x34], 0
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x44], eax
cmp dword [eax], 0
jle 0x46738e
lea edi, [eax + 0x14]
push edx
push dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea ecx, [edi - 0xc]
call fcn.00466f82
pop ecx
pop ecx
test eax, eax
je 0x467365
mov eax, dword [ebp - 0xc]
test eax, eax
jle 0x467285
mov eax, dword [ebp - 0x14]
test dword [eax + 0x28], 0x400
je 0x46726e
mov edx, dword [ebp + 0xc]
mov ecx, dword [eax + 0x30]
call fcn.00478c38
test eax, eax
js 0x46726e
mov eax, dword [ebp - 0x14]
mov al, byte [eax + 0x24]
test al, 0x10
je 0x467365
test al, 8
jne 0x467258
mov edx, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0xc], eax
test edx, edx
je 0x46727f
jmp 0x467275
movzx eax, word [esi + 0x20]
lea edx, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
mov ecx, ebx
call fcn.0046709a
pop ecx
pop ecx
jmp 0x467282
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x46727d
mov ecx, dword [ebp - 0x10]
call fcn.0046ac05
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x34]
inc eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
mov word [esi + 0x20], cx
inc eax
or dword [edi], 0x40
test byte [edi], 0x80
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x3c], eax
je 0x46736b
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x48]
inc ecx
add edi, 0x48
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], edi
cmp ecx, dword [eax]
jl 0x4671cc
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x4672f3
mov eax, dword [edx + 0x2c]
mov dword [esi + 0x1c], eax
mov eax, dword [edx + 0x10]
mov dword [esi + 0x2c], eax
test byte [edx + 0x24], 0x48
je 0x4672ed
or dword [esi + 4], 0x200000
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x46778f
cmp dword [ebp - 8], 0
jne 0x467659
mov edx, dword [ebx + 0x7c]
xor eax, eax
mov edi, eax
mov dword [ebp - 0x14], edi
test edx, edx
je 0x467583
cmp byte [ebx + 0x99], 0
mov al, byte [ebx + 0x98]
mov byte [ebp - 1], al
je 0x46753a
mov ecx, dword [ebp + 0x10]
test dword [ecx + 0x18], 0x400
je 0x467583
cmp dword [ebp + 8], edi
je 0x467357
mov edx, dword [edx]
mov ecx, dword [ebp + 8]
call fcn.00441c65
test eax, eax
jne 0x467583
xor eax, eax
cmp byte [ebp - 1], 0x80
setne al
jmp 0x46757a
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x44]
inc ecx
add edi, 0x14
mov dword [ebp - 0x34], ecx
cmp ecx, dword [edx]
mov edx, dword [ebp - 8]
jl 0x4671fd
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
test eax, eax
jne 0x4672b5
cmp dword [ebp + 8], 0
mov edx, dword [ebp - 8]
je 0x4672b8
mov eax, dword [ebp - 0x2c]
test edx, edx
je 0x4673cc
mov esi, dword [ebp - 0x24]
cmp dword [eax + 0x3c], esi
mov esi, dword [ebp + 0x14]
jne 0x4672b8
cmp dword [ebp - 0x24], 0
jne 0x4673cc
push 0x4d3734
push edx
call fcn.004b5b50
pop ecx
pop ecx
test eax, eax
jne 0x4672b2
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4673df
mov ecx, edi
jmp 0x4673e4
cmp dword [ebp + 8], 0
je 0x46740f
jmp 0x46739e
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
call fcn.00441c65
test eax, eax
jne 0x4672af
cmp byte [ebx + 0xd4], 2
jb 0x46740f
test edi, edi
je 0x46740f
lea eax, [esi + 0x2c]
xor edx, edx
push eax
mov ecx, ebx
call fcn.0046fe88
pop ecx
mov ecx, dword [ebp + 0xc]
call fcn.00441cfa
mov ecx, dword [ebp - 0x2c]
mov dl, al
xor eax, eax
mov byte [ebp - 1], dl
mov dword [ebp - 0x34], eax
mov edi, dword [ecx + 4]
movsx ecx, word [ecx + 0x22]
mov dword [ebp - 0x3c], ecx
test ecx, ecx
jle 0x46748b
cmp byte [edi + 0xa], dl
jne 0x467480
mov edx, dword [ebp + 0xc]
mov ecx, dword [edi]
call fcn.00441c65
test eax, eax
jne 0x467477
cmp dword [ebp - 0xc], eax
jle 0x4674ff
mov eax, dword [ebp - 0x14]
test dword [eax + 0x28], 0x400
je 0x4674eb
mov edx, dword [ebp + 0xc]
mov ecx, dword [eax + 0x30]
call fcn.00478c38
test eax, eax
js 0x4674eb
mov eax, dword [ebp - 0x14]
mov al, byte [eax + 0x24]
test al, 0x10
jne 0x4674b8
mov dl, byte [ebp - 1]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
inc eax
add edi, 0x10
mov dword [ebp - 0x34], eax
cmp eax, ecx
jl 0x467432
mov edi, dword [ebp - 0x14]
cmp dword [ebp - 0xc], 0
jne 0x4672af
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 8]
test dword [eax + 0x1c], 0x200
jne 0x4674b0
inc dword [ebp - 0x28]
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x14]
jmp 0x4672b8
test al, 8
jne 0x4674d5
mov edx, dword [ebp - 0x18]
xor edi, edi
mov dword [ebp - 0xc], edi
test edx, edx
je 0x4674d0
mov ecx, dword [ebp - 0x10]
call fcn.0046ac05
mov dword [ebp - 0x18], edi
jmp 0x4674ff
movzx eax, word [esi + 0x20]
lea edx, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
mov ecx, ebx
call fcn.0046709a
pop ecx
pop ecx
jmp 0x4674ff
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x4674fa
mov ecx, dword [ebp - 0x10]
call fcn.0046ac05
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x2c]
inc dword [ebp - 0xc]
mov edx, dword [ebp - 0x34]
mov edi, dword [ebp - 0x14]
movsx eax, word [eax + 0x20]
cmp edx, eax
movzx ecx, dx
push 0xffffffffffffffff
pop eax
cmove ecx, eax
mov dword [ebp - 0x1c], edi
mov word [esi + 0x20], cx
test dword [edi + 0x28], 0x2000
je 0x46748e
mov ecx, edi
call fcn.00486f16
jmp 0x46748e
cmp al, 0x80
je 0x467564
cmp dword [ebp + 8], edi
je 0x467560
mov edx, dword [ebp + 8]
mov ecx, 0x4d3738
call fcn.00441c65
test eax, eax
jne 0x46755d
mov dword [esi + 0x1c], 1
jmp 0x46757d
mov al, byte [ebp - 1]
cmp al, 0x7f
je 0x467583
cmp dword [ebp + 8], edi
je 0x467583
mov edx, dword [ebp + 8]
mov ecx, 0x4d373c
call fcn.00441c65
test eax, eax
jne 0x467583
mov dword [esi + 0x1c], eax
mov edi, dword [ebx + 0x7c]
mov dword [ebp - 0x14], edi
mov ecx, dword [ebp + 0x10]
test dword [ecx + 0x18], 0x200
je 0x4675c2
cmp dword [ebp + 8], 0
je 0x4675c2
cmp dword [ecx + 8], 0
je 0x4675c2
mov edx, dword [ebp + 8]
mov ecx, str.excluded
call fcn.00441c65
test eax, eax
jne 0x4675c2
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 8]
mov eax, dword [eax + 0x20]
mov edi, dword [eax + 0x18]
mov dword [ebp - 0x14], edi
mov dword [esi + 0x1c], 2
test edi, edi
je 0x467659
mov ecx, dword [ebp + 0xc]
call fcn.00441cfa
mov ecx, dword [ebp - 0x14]
inc dword [ebp - 0x28]
mov byte [ebp - 1], al
mov eax, dword [edi + 0x3c]
movsx edx, word [ecx + 0x22]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x48], edx
mov edi, eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x3c], eax
test edx, edx
jle 0x467627
mov cl, byte [ebp - 1]
cmp byte [eax + 0xa], cl
jne 0x467619
mov edx, dword [ebp + 0xc]
mov ecx, dword [eax]
call fcn.00441c65
test eax, eax
je 0x4676c8
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x48]
mov cl, byte [ebp - 1]
inc edi
add eax, 0x10
mov dword [ebp - 0x3c], eax
cmp edi, edx
jl 0x4675f9
mov ecx, dword [ebp - 0x14]
movzx eax, word [ecx + 0x22]
cwde
cmp edi, eax
jl 0x46764c
mov ecx, dword [ebp + 0xc]
call fcn.0046b100
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x46764c
test dword [ecx + 0x1c], 0x200
push 0xffffffffffffffff
pop eax
cmove edi, eax
movzx eax, word [ecx + 0x22]
cwde
cmp edi, eax
jl 0x4677a0
cmp dword [ebp - 0x28], 1
mov edi, dword [ebp + 0x10]
jne 0x46768d
cmp dword [ebp - 0x1c], 0
je 0x46768d
test byte [edi + 0x18], 0x28
jne 0x46768d
mov ecx, dword [ebp + 0xc]
call fcn.0046b100
test eax, eax
je 0x46768d
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x10]
test dword [eax + 0x1c], 0x200
je 0x46787b
test byte [edi + 0x18], 0x80
je 0x467710
cmp dword [ebp + 8], 0
jne 0x467710
mov ecx, dword [edi + 8]
xor eax, eax
mov dword [ebp - 0x3c], eax
mov edx, dword [ecx]
mov dword [ebp - 0x34], edx
test edx, edx
jle 0x467710
lea edx, [ecx + 0x14]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x2c], edx
test byte [edx], 3
mov edi, dword [edx - 8]
jne 0x4676ff
test edi, edi
jne 0x4676dc
mov ecx, dword [ebp + 0xc]
neg ecx
sbb ecx, ecx
jmp 0x4676f4
mov ecx, dword [ebp - 0x14]
push 0xffffffffffffffff
movsx eax, word [ecx + 0x20]
cmp edi, eax
pop eax
cmove edi, eax
jmp 0x467627
cmp dword [ebp + 0xc], 0
je 0x4676ff
mov edx, dword [ebp + 0xc]
mov ecx, edi
call fcn.00441c65
mov edx, dword [ebp - 0x2c]
mov ecx, eax
mov eax, dword [ebp - 0x3c]
test ecx, ecx
je 0x467892
mov ecx, dword [ebp - 0x34]
inc eax
add edx, 0x14
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], edx
cmp eax, ecx
jl 0x4676b3
mov edi, dword [ebp + 0x10]
mov edi, dword [edi + 0xc]
inc dword [ebp - 0x40]
mov dword [ebp + 0x10], edi
test edi, edi
jne 0x4671a8
cmp dword [ebp + 8], edi
jne 0x46797f
test byte [esi + 4], 0x80
je 0x467974
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0xb1], 0
jne 0x467946
mov ecx, dword [ebp - 0x38]
test dword [ecx + 0x18], 0x10000
je 0x467939
mov ecx, eax
call fcn.00474aac
xor ecx, ecx
test eax, eax
je 0x467774
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x20]
and eax, 0x40000000
or eax, ecx
jne 0x467946
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x20]
and eax, 0x20000000
or eax, ecx
je 0x467933
xor eax, eax
inc eax
jmp 0x467935
mov edi, dword [ebp + 0x10]
cmp eax, 1
je 0x467a67
jmp 0x467982
xor edx, edx
mov dword [ebp - 0xc], 1
cmp dword [esi + 0x1c], 2
mov dword [ebp - 0x1c], edx
movzx eax, di
jne 0x4677f6
cmp byte [ebx + 0xd4], 2
mov edx, eax
jb 0x4677d6
mov edi, dword [ebp + 0x10]
mov word [esi + 0x20], dx
mov dword [esi + 0x2c], ecx
mov dword [ebp - 0x30], 0xa7
jmp 0x467a67
call fcn.00474bf1
mov edi, dword [ebp + 0x10]
movsx ecx, ax
mov dword [ebp - 0x30], 0xb0
mov eax, dword [edi + 8]
add ecx, dword [eax + 0x24]
mov dword [esi + 0x1c], ecx
jmp 0x467a67
mov dword [esi + 0x2c], ecx
cmp byte [ebx + 0x99], dl
je 0x467835
mov edx, eax
mov dword [ebp - 0x30], 0xb0
mov byte [esi + 2], 0xa7
call fcn.00474bf1
mov edi, dword [ebp + 0x10]
movsx ecx, ax
mov eax, dword [ebp - 0x14]
movsx eax, word [eax + 0x22]
inc eax
imul eax, dword [esi + 0x1c]
add ecx, eax
mov eax, dword [edi + 8]
inc eax
add eax, ecx
mov dword [esi + 0x1c], eax
jmp 0x467a67
mov word [esi + 0x20], ax
mov dword [ebp - 0x30], 0x4d
test edi, edi
jns 0x467850
mov byte [esi + 1], 0x44
mov edi, dword [ebp + 0x10]
jmp 0x467a69
xor eax, eax
mov ecx, edi
inc eax
shl eax, cl
push 0xffffffffffffffff
pop ecx
cmp dword [esi + 0x1c], edx
jne 0x46786d
cmp edi, 0x20
cmovge eax, ecx
or dword [ebx + 0x90], eax
jmp 0x467848
cmp edi, 0x20
cmovge eax, ecx
or dword [ebx + 0x94], eax
jmp 0x467848
or eax, 0xffffffff
mov dword [ebp - 0xc], 1
mov word [esi + 0x20], ax
mov byte [esi + 1], 0x44
jmp 0x467a67
mov ecx, dword [ebp + 0x10]
imul eax, eax, 0x14
mov edx, dword [ecx + 8]
mov edx, dword [eax + edx + 8]
mov eax, ecx
test byte [eax + 0x18], 1
jne 0x4678c4
test byte [edx + 4], 0x10
je 0x4678c4
push edi
push str.misuse_of_aliased_aggregate__s
push ebx
call fcn.00441b18
add esp, 0xc
push 2
pop eax
pop edi
pop esi
pop ebx
leave
ret
test dword [edx + 4], 0x8000
je 0x4678e3
test dword [eax + 0x18], 0x4000
je 0x4678db
cmp eax, dword [ebp - 0x38]
je 0x4678e3
push edi
push str.misuse_of_aliased_window_function__s
jmp 0x4678b3
mov ecx, edx
call fcn.00469495
cmp eax, 1
je 0x4678fe
push str.row_value_misused
push ebx
call fcn.00441b18
pop ecx
pop ecx
jmp 0x4678bc
mov eax, dword [ebp - 0x40]
mov ecx, ebx
mov edi, dword [ebp + 0x10]
push eax
push esi
push dword [ebp - 0x3c]
mov edx, dword [edi + 8]
call fcn.00466e7b
add esp, 0xc
cmp byte [ebx + 0xd4], 2
jb 0x467acc
push esi
xor edx, edx
mov ecx, ebx
call fcn.0046fe88
pop ecx
jmp 0x467acc
mov eax, ecx
test eax, eax
jmp 0x467944
mov eax, dword [eax + 0x20]
and eax, 0x40000000
or eax, 0
je 0x467974
push dword [ebp + 0xc]
push str.double_quoted_string_literal:___w_
push 0x1c
call fcn.00440ec2
add esp, 0xc
mov byte [esi], 0x75
xor eax, eax
lea ecx, [esi + 0x2c]
push 8
push eax
push ecx
call fcn.004b21c0
add esp, 0xc
xor eax, eax
inc eax
jmp 0x4678bf
mov ecx, esi
call fcn.0046aca1
test eax, eax
jne 0x46796c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x4679fb
dec eax
cmp dword [edx], eax
jne 0x4679f3
mov eax, dword [esi + 4]
test eax, 0x800000
je 0x4679a2
and eax, 0xff7fffff
mov dword [esi + 4], eax
jmp 0x4679ca
mov edx, dword [esi + 0xc]
test edx, edx
je 0x4679b1
mov ecx, dword [ebp - 0x10]
call fcn.00469f9d
mov edx, dword [esi + 0x10]
xor eax, eax
mov dword [esi + 0xc], eax
test edx, edx
je 0x4679c7
mov ecx, dword [ebp - 0x10]
call fcn.00469f9d
xor eax, eax
mov dword [esi + 0x10], eax
movzx eax, word [esi + 0x20]
lea edx, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
mov ecx, ebx
call fcn.0046709a
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov byte [esi], 0xac
mov dword [esi + 8], str.coalesce
mov dword [esi + 0x14], eax
jmp 0x467acc
mov ecx, dword [ebp - 0x10]
call fcn.0046ac05
cmp dword [ebp - 0xc], 0
mov ecx, str.ambiguous_column_name
push dword [ebp + 0xc]
mov eax, str.no_such_column
cmovne eax, ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x467a2b
push dword [ebp + 8]
push ecx
push eax
push str._s:__s._s._s
push ebx
call fcn.00441b18
add esp, 0x18
jmp 0x467a54
cmp dword [ebp + 8], 0
je 0x467a45
push dword [ebp + 8]
push eax
push str._s:__s._s
push ebx
call fcn.00441b18
add esp, 0x14
jmp 0x467a54
push eax
push str._s:__s
push ebx
call fcn.00441b18
add esp, 0x10
mov ecx, dword [ebx]
mov edx, esi
call fcn.004408cb
mov eax, dword [ebp - 0x38]
mov byte [ebx + 0x11], 1
inc dword [eax + 0x14]
xor edx, edx
test dword [esi + 4], 0x810000
jne 0x467aa1
mov edx, dword [esi + 0xc]
test edx, edx
je 0x467a81
mov ecx, dword [ebp - 0x10]
call fcn.00469f9d
mov edx, dword [esi + 0x10]
xor eax, eax
mov dword [esi + 0xc], eax
test edx, edx
je 0x467a95
mov ecx, dword [ebp - 0x10]
call fcn.00469f9d
xor edx, edx
or dword [esi + 4], 0x800000
mov dword [esi + 0x10], edx
cmp word [esi + 0x20], dx
jl 0x467abd
cmp dword [ebp - 0x1c], 0
je 0x467abd
mov ecx, esi
call fcn.00467028
mov ecx, dword [ebp - 0x1c]
or dword [ecx + 0x38], eax
or dword [ecx + 0x3c], edx
mov eax, dword [ebp - 0x30]
mov byte [esi], al
cmp dword [ebp - 0xc], 1
jne 0x4678bc
mov eax, dword [ebx]
xor ecx, ecx
cmp dword [eax + 0x16c], ecx
je 0x467af3
mov al, byte [esi]
cmp al, 0xa7
je 0x467ae2
cmp al, 0x4d
jne 0x467af3
push dword [edi + 4]
mov edx, esi
mov ecx, ebx
push dword [ebp - 0x24]
call fcn.00473ac6
pop ecx
pop ecx
mov eax, dword [ebp - 0x38]
jmp 0x467afb
mov eax, dword [eax + 0xc]
inc dword [eax + 0x10]
cmp eax, edi
jne 0x467af8
jmp 0x46796c