Function at 0x463590
Capabilities:
Persist via lnk shortcut
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4aee56
mov eax, dword fs:[0]
push eax
mov eax, 0x18c4
call fcn.0049f030
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x18c0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c0390]
xor eax, esp
push eax
lea eax, [esp + 0x18d8]
mov dword fs:[0], eax
mov edi, dword [esp + 0x18e8]
mov esi, ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x2c], edi
call fcn.0042f360
mov dword [esp + 0x18e0], 0
lea eax, [esp + 0x14d4]
push eax
lea ecx, [esp + 0x10d8]
push ecx
mov ecx, 0x4e2960
call fcn.00467770
cmp byte [edi + 0x32a1], 0
lea eax, [edi + 0x32a1]
je 0x46362c
lea edx, [esp + 0x10d4]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x463622
cmp byte [edi + 0x36a1], 0
lea eax, [edi + 0x36a1]
je 0x46364e
lea edx, [esp + 0x14d4]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x463644
lea ebx, [edi + 0x410]
mov byte [esi + 0xc20], 0
cmp byte [ebx], 0
je 0x46375c
cmp byte [esp + 0x10d4], 0
jne 0x463685
cmp byte [esp + 0x14d4], 0
jne 0x463685
cmp byte [edi + 0x3aa1], 0
je 0x46375c
push 0
push ebx
call fcn.00430550
test al, al
je 0x46375c
lea edx, [esi + 0x1020]
mov eax, ebx
sub edx, ebx
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4636a0
lea ebp, [esi + 0xc20]
push ebp
push 0x4b3f50
mov dword [esi + 0x1420], ebx
call fcn.0047fbc0
mov edi, eax
test edi, edi
je 0x46398b
call fcn.0043d660
test eax, eax
je 0x4639b1
push ebx
call fcn.004605a0
test al, al
jne 0x4639b1
push ebx
call fcn.00460650
test al, al
je 0x46375c
push edi
call fcn.004a0026
mov esi, 0x10000
push esi
call fcn.0049eb7f
mov edi, eax
add esp, 8
mov dword [esp + 0x20], edi
test edi, edi
jne 0x463718
mov ecx, 0x4c9364
call fcn.00428ea0
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov byte [esp + 0x18e0], 1
push esi
push ebx
mov ecx, edi
call fcn.00460710
push 0
push ebp
mov dword [esp + 0x24], eax
call dword [0x4b11cc]
mov esi, eax
test esi, esi
jne 0x463793
mov byte [esp + 0x18e0], al
test edi, edi
je 0x463758
push edi
call fcn.0049e7fd
add esp, 4
mov esi, dword [esp + 0x18]
mov dword [esp + 0x18e0], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x18d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18c0]
xor ecx, esp
call fcn.0049eaa6
add esp, 0x18d0
ret 4
push 3
push 0
push ebp
mov byte [esp + 0x23], 0
mov byte [esp + 0x22], 0
call dword [0x4b11b8]
mov edi, eax
test edi, edi
je 0x463827
cmp byte [esp + 0x10d4], 0
mov ebp, dword [0x4b11c8]
je 0x4637e7
push esi
push 0x45f970
push 3
push edi
call ebp
push esi
push 0x45f970
push 0xe
push edi
call ebp
push 0x64
push esi
lea eax, [esp + 0x10dc]
call fcn.00460240
mov byte [esp + 0x17], al
cmp byte [esp + 0x14d4], 0
je 0x463820
cmp byte [esp + 0x10d4], 0
je 0x463802
cmp byte [esp + 0x17], 0
je 0x463820
push esi
push 0x45f970
push 2
push edi
call ebp
push 0x65
push esi
lea eax, [esp + 0x14dc]
call fcn.00460430
mov byte [esp + 0x16], al
push edi
call dword [0x4b1394]
push 0
push esi
call dword [0x4b11c4]
test eax, eax
je 0x4638ee
cmp byte [esp + 0x14d4], 0
je 0x46384d
cmp byte [esp + 0x16], 0
je 0x4638ee
cmp byte [esp + 0x17], 0
jne 0x46386c
cmp byte [esp + 0x16], 0
jne 0x46386c
mov edx, dword [esp + 0x2c]
cmp byte [edx + 0x3aa1], 0
je 0x46391a
mov eax, dword [esp + 0x2c]
cmp byte [eax + 0x3aa1], 0
je 0x463888
mov eax, dword [esp + 0x18]
add eax, 0xc20
push eax
call fcn.00460840
lea ecx, [esp + 0x34]
call fcn.00401d40
mov esi, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x38]
push ecx
push 0
add esi, 0xc20
push esi
call fcn.00433eb0
test al, al
je 0x463908
mov eax, dword [esp + 0x1c]
xor edx, edx
add eax, dword [esp + 0xc34]
adc edx, dword [esp + 0xc38]
mov dword [esp + 0x30], edx
js 0x463908
jg 0x4638d1
cmp eax, 0x80000
jbe 0x463908
push 0x80000
push 0x5a0
call fcn.0045c9e0
push eax
push 0x4e758c
call fcn.00445f90
add esp, 0xc
mov byte [esp + 0x18e0], 0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x463758
push eax
jmp 0x463750
mov edx, ebx
mov eax, esi
sub edx, esi
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x463910
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
test ebx, ebx
je 0x463972
mov esi, dword [esp + 0x18]
push 0x10000
add esi, 0xc20
push esi
mov ecx, edi
call fcn.00460710
test eax, eax
jne 0x463972
push 0x4b3764
push esi
call fcn.004a0348
mov esi, eax
add esp, 8
test esi, esi
je 0x463972
push 2
push 0
push esi
call fcn.004a08a5
push esi
push ebx
push 1
push edi
call fcn.004a0202
push esi
call fcn.004a0026
add esp, 0x20
mov byte [esp + 0x18e0], 0
test edi, edi
je 0x463987
push edi
call fcn.0049e7fd
add esp, 4
mov esi, dword [esp + 0x18]
cmp byte [esi + 0xc20], 0
lea eax, [esi + 0xc20]
je 0x46375c
push 0
push 1
push 0
push eax
mov ecx, esi
call fcn.0042f750
jmp 0x46375c
cmp byte [esp + 0x10d4], 0
je 0x46398b
lea eax, [esp + 0x10d4]
push eax
push edi
push ebx
mov ecx, esi
call fcn.00462c70
test al, al
je 0x46398b
mov edx, ebx
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4639d6
push edi
call fcn.004a0026
add esp, 4
jmp 0x46398b