Function at 0x46e070
Capabilities:
Persist via run registry key

Disassembly:
mov eax, 0x2930
call fcn.0047b0c0
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2944]
mov eax, dword [edi + 0x1d80]
xor ebx, ebx
cmp dword [eax], ebx
je 0x46e0ec
mov ecx, edi
call fcn.0040a1c0
lea ecx, [edi + 0xbc]
push ecx
call 0x462760
lea esi, [edi + 0xa8]
call fcn.0046afd0
test eax, eax
jne 0x46e0e1
call fcn.0046abf0
mov eax, dword [esi + 4]
cmp eax, ebx
mov dword [esi + 0xc], ebx
je 0x46e0cd
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esi + 4], ebx
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 0xc], ebx
je 0x46e0e1
push eax
call dword [0x47c1cc]
mov dword [esi + 8], ebx
lea eax, [edi + 0x1d58]
call fcn.0040f6c0
mov ecx, dword [edi + 0x1d80]
cmp dword [ecx + 4], ebx
mov edi, 0x100
je 0x46e5bb
mov esi, dword [esp + 0x2944]
xor ebp, ebp
push 0x20a
lea edx, [esp + 0x2316]
push ebp
push edx
mov dword [esi + 0x1d7c], ebp
mov word [esp + 0x231c], bp
call fcn.0047b0b0
add esp, 0xc
lea eax, [esp + 0x2310]
push eax
call fcn.00471690
lea ecx, [esp + 0x2310]
push 0x5c
push ecx
call fcn.00401a84
add esp, 8
cmp eax, ebp
je 0x46e153
mov word [eax], bp
mov ecx, dword [esi + 0x1d80]
mov edx, dword [ecx + 0x24]
cmp edx, ebp
lea eax, [esp + 0x2310]
je 0x46e232
cmp word [ecx + 0x2c], bp
lea esi, [ecx + 0x2c]
je 0x46e176
mov eax, esi
cmp edx, ebp
je 0x46e232
cmp word [ecx + 0x2c], bp
je 0x46e232
mov ebp, dword [esp + 0x2944]
add ecx, 0x440
push ecx
lea ebx, [ebp + 0xc0]
push ebx
call fcn.00469590
mov edx, dword [ebp + 0x1d80]
xor esi, esi
add edx, 0x2c
mov dword [esp + 0x38], edi
push edx
lea edi, [esp + 0x24]
mov dword [esp + 0x38], 0x400
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x2c], esi
call fcn.0046dda0
mov edi, dword [esp + 0x3c]
cmp edi, esi
mov ebp, dword [esp + 0x30]
jle 0x46e21f
test esi, esi
jl 0x46e1fc
cmp esi, edi
jge 0x46e1fc
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + esi*4]
lea eax, [ebp + ecx*2]
jmp 0x46e1fe
xor eax, eax
mov edx, dword [esp + 0x2944]
mov ecx, dword [edx + 0x1d80]
add ecx, 0x440
push ecx
push ebx
call fcn.00469590
add esi, 1
cmp esi, edi
jl 0x46e1e7
push ebp
call fcn.00401aae
mov edx, dword [esp + 0x30]
add esp, 4
push edx
jmp 0x46e2c4
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x38], 0x400
mov dword [esp + 0x3c], edi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x2c], ebp
call fcn.00470650
mov edi, dword [esp + 0x3c]
xor esi, esi
cmp edi, ebp
jle 0x46e2b2
mov ebx, dword [esp + 0x2944]
add ebx, 0xc0
cmp esi, ebp
jl 0x46e28f
cmp esi, edi
jge 0x46e28f
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + esi*4]
mov eax, dword [esp + 0x30]
lea eax, [eax + edx*2]
jmp 0x46e291
xor eax, eax
mov ecx, dword [esp + 0x2944]
mov edx, dword [ecx + 0x1d80]
add edx, 0x440
push edx
push ebx
call fcn.00469590
add esi, 1
cmp esi, edi
jl 0x46e277
mov eax, dword [esp + 0x30]
push eax
call fcn.00401aae
mov ecx, dword [esp + 0x30]
add esp, 4
push ecx
call fcn.00401aae
mov ebx, dword [esp + 0x2948]
mov edx, dword [ebx + 0x1d80]
xor edi, edi
add esp, 4
cmp dword [edx + 0x24], edi
jne 0x46e5bb
mov eax, 0x20
mov dword [esp + 0x40], eax
mov dword [esp + 0x50], eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
call fcn.0046bc10
call fcn.00469e60
mov edx, dword [0x48bc04]
xor eax, eax
cmp edx, edi
jle 0x46e366
mov esi, dword [0x48bbf8]
cmp eax, edi
jl 0x46e34e
cmp eax, edx
jge 0x46e34e
mov ecx, esi
jmp 0x46e350
xor ecx, ecx
cmp dword [ecx], 0x1f7
je 0x46e433
add eax, 1
add esi, 8
cmp eax, edx
jl 0x46e342
mov eax, 0x47c484
push eax
lea edx, [esp + 0x24]
push edx
call fcn.0046b580
mov esi, eax
cmp esi, edi
je 0x46e58a
push 0x208
lea eax, [esp + 0x18c6]
push edi
push eax
mov word [esp + 0x18cc], di
call fcn.0047b0b0
add esp, 0xc
push 0x208
lea ecx, [esp + 0x1ad6]
push edi
push ecx
mov word [esp + 0x1adc], di
call fcn.0047b0b0
add esp, 0xc
push 0x208
lea edx, [esp + 0x16b6]
push edi
push edx
mov word [esp + 0x16bc], di
call fcn.0047b0b0
add esp, 0xc
push 0x208
lea eax, [esp + 0x1ef6]
push edi
push eax
mov word [esp + 0x1efc], di
call fcn.0047b0b0
lea eax, [esi + 4]
lea edx, [esp + 0x18cc]
add esp, 0xc
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, di
jne 0x46e404
lea ecx, [esp + 0x18c0]
push 0x5c
push ecx
call fcn.00401a84
add esp, 8
cmp eax, edi
jne 0x46e460
mov word [esp + 0x18c0], di
jmp 0x46e463
mov ecx, dword [ecx + 4]
cmp ecx, edi
jl 0x46e459
cmp ecx, dword [0x48bbf4]
jge 0x46e459
mov edx, dword [0x48bbe4]
mov eax, dword [edx + ecx*4]
mov ecx, dword [0x48bbe8]
lea eax, [ecx + eax*2]
jmp 0x46e36b
xor eax, eax
jmp 0x46e36b
mov word [eax], di
xor eax, eax
jmp 0x46e470
movzx ecx, word [esp + eax + 0x18c0]
mov word [esp + eax + 0x1ad0], cx
add eax, 2
cmp cx, di
jne 0x46e470
lea edx, [esp + 0x1ad0]
push 0x5c
push edx
call fcn.00401a84
add esp, 8
cmp eax, edi
jne 0x46e4a8
mov word [esp + 0x1ad0], di
jmp 0x46e4ab
mov word [eax], di
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [esp + eax + 0x1ad0]
mov word [esp + eax + 0x16b0], cx
add eax, 2
cmp cx, di
jne 0x46e4b0
lea eax, [esp + 0x16b0]
push 0x5c
push eax
call fcn.00401a84
add esp, 8
cmp eax, edi
jne 0x46e4eb
mov word [esp + 0x16b0], di
jmp 0x46e58a
mov word [eax], di
cmp word [esp + 0x16b0], di
je 0x46e58a
call fcn.00469e60
mov edx, dword [0x48bc04]
xor eax, eax
cmp edx, edi
jle 0x46e537
mov esi, dword [0x48bbf8]
cmp eax, edi
jl 0x46e51f
cmp eax, edx
jge 0x46e51f
mov ecx, esi
jmp 0x46e521
xor ecx, ecx
cmp dword [ecx], 0x1f8
je 0x46e645
add eax, 1
add esi, 8
cmp eax, edx
jl 0x46e513
mov eax, 0x47c484
push 0x104
push eax
lea eax, [esp + 0x1ef8]
lea ecx, [esp + 0x16b8]
call 0x465830
add esp, 8
lea edx, [esp + 0x1ef0]
push edx
call dword [0x47c0d4]
cmp eax, 0xffffffff
je 0x46e58a
mov eax, dword [ebx + 0x1d80]
add eax, 0x440
push eax
add ebx, 0xc0
push ebx
lea eax, [esp + 0x1ef8]
call fcn.00469590
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x46e599
push eax
call dword [0x47c1cc]
mov eax, dword [esp + 0x48]
cmp eax, edi
je 0x46e5aa
push eax
call fcn.00401aae
add esp, 4
mov eax, dword [esp + 0x38]
cmp eax, edi
je 0x46e5bb
push eax
call fcn.00401aae
add esp, 4
mov ecx, dword [esp + 0x2944]
mov edx, dword [ecx + 0x1d80]
xor edi, edi
cmp dword [edx + 0x14], edi
je 0x46e69e
xor esi, esi
mov eax, ecx
lea ecx, [esp + 0x20]
push ecx
mov dword [eax + 0x1d7c], 0xb
mov dword [esp + 0x38], 0x400
mov dword [esp + 0x3c], 0x100
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x2c], esi
call fcn.00470ad0
mov edi, dword [esp + 0x3c]
cmp edi, esi
mov ebp, dword [esp + 0x30]
jle 0x46e686
mov ebx, dword [esp + 0x2944]
add ebx, 0xc0
lea esp, [esp]
test esi, esi
jl 0x46e672
cmp esi, edi
jge 0x46e672
mov edx, dword [esp + 0x2c]
mov eax, dword [edx + esi*4]
lea eax, [ebp + eax*2]
jmp 0x46e674
mov ecx, dword [ecx + 4]
cmp ecx, edi
jl 0x46e66b
cmp ecx, dword [0x48bbf4]
jge 0x46e66b
mov edx, dword [0x48bbe4]
mov eax, dword [edx + ecx*4]
mov ecx, dword [0x48bbe8]
lea eax, [ecx + eax*2]
jmp 0x46e53c
xor eax, eax
jmp 0x46e53c
xor eax, eax
push 0x47c484
push ebx
call fcn.00469590
add esi, 1
cmp esi, edi
jl 0x46e630
push ebp
call fcn.00401aae
mov ecx, dword [esp + 0x30]
add esp, 4
push ecx
call fcn.00401aae
add esp, 4
xor edi, edi
mov edx, dword [esp + 0x2944]
mov eax, dword [edx + 0x1d80]
cmp dword [eax + 0x20], edi
je 0x46e751
xor esi, esi
mov ecx, edx
lea edx, [esp + 0x20]
push edx
mov dword [ecx + 0x1d7c], 0xf
mov dword [esp + 0x38], 0x400
mov dword [esp + 0x3c], 0x100
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x2c], esi
call fcn.00470f50
mov edi, dword [esp + 0x3c]
cmp edi, esi
mov ebp, dword [esp + 0x30]
jle 0x46e739
mov ebx, dword [esp + 0x2944]
add ebx, 0xc0
lea ecx, [ecx]
test esi, esi
jl 0x46e725
cmp esi, edi
jge 0x46e725
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + esi*4]
lea eax, [ebp + ecx*2]
jmp 0x46e727
xor eax, eax
push 0x47c484
push ebx
call fcn.00469590
add esi, 1
cmp esi, edi
jl 0x46e710
push ebp
call fcn.00401aae
mov edx, dword [esp + 0x30]
add esp, 4
push edx
call fcn.00401aae
add esp, 4
xor edi, edi
mov eax, dword [esp + 0x2944]
mov ecx, dword [eax + 0x1d80]
cmp dword [ecx + 0x18], edi
mov ebp, dword [0x47c014]
je 0x46e94c
push 0x208
lea edx, [esp + 0x1ce6]
push edi
push edx
mov word [esp + 0x1cec], di
call fcn.0047b0b0
add esp, 0xc
push 0x208
lea eax, [esp + 0x2736]
push edi
push eax
mov word [esp + 0x273c], di
call fcn.0047b0b0
add esp, 0xc
cmp dword [0x48ba20], edi
jne 0x46e7d5
mov ebx, str.shell32.dll
call fcn.004651a0
cmp eax, edi
mov dword [0x48ba20], eax
je 0x46e7d5
push str.SHGetSpecialFolderPathW
push eax
call dword [0x47c188]
mov dword [0x48ba1c], eax
cmp dword [0x48ba1c], edi
je 0x46e811
cmp dword [0x48b90c], edi
jne 0x46e7fa
push 0x48b908
mov dword [0x48b908], 0x114
call dword [0x47c0c0]
push edi
push 0x1c
lea ecx, [esp + 0x2738]
push ecx
push edi
call dword [0x48ba1c]
jmp 0x46e8b5
push 0x206
lea edx, [esp + 0x66]
push edi
push edx
mov word [esp + 0x6c], di
call fcn.0047b0b0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call ebp
cmp eax, edi
jne 0x46e892
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x64]
push edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x24]
push eax
push edi
lea ecx, [esp + 0x30]
push ecx
push edx
mov dword [esp + 0x2c], 0x208
call dword [0x47c008]
test eax, eax
jne 0x46e887
mov eax, dword [esp + 0x14]
cmp eax, 2
jb 0x46e882
shr eax, 1
mov word [esp + eax*2 + 0x60], di
jmp 0x46e887
mov word [esp + 0x60], di
mov eax, dword [esp + 0x18]
push eax
call dword [section..rdata]
xor eax, eax
jmp 0x46e8a0
movzx ecx, word [esp + eax + 0x60]
mov word [esp + eax + 0x2730], cx
add eax, 2
cmp cx, di
jne 0x46e8a0
call fcn.00469e60
mov edx, dword [0x48bc04]
xor eax, eax
cmp edx, edi
jle 0x46e8f4
mov esi, dword [0x48bbf8]
lea esp, [esp]
cmp eax, edi
jl 0x46e8dc
cmp eax, edx
jge 0x46e8dc
mov ecx, esi
jmp 0x46e8de
xor ecx, ecx
cmp dword [ecx], 0x1f9
je 0x46ea06
add eax, 1
add esi, 8
cmp eax, edx
jl 0x46e8d0
mov eax, 0x47c484
push 0x104
push eax
lea eax, [esp + 0x1ce8]
lea ecx, [esp + 0x2738]
call 0x465830
add esp, 8
lea edx, [esp + 0x1ce0]
push edx
call dword [0x47c0d4]
cmp eax, 0xffffffff
je 0x46e94c
mov eax, dword [esp + 0x2944]
lea ecx, [esp + 0x1ce0]
mov dword [eax + 0x1d7c], 0xd
push ecx
add eax, 0x4a4
push eax
call fcn.00413490
mov edx, dword [esp + 0x2944]
mov eax, dword [edx + 0x1d80]
cmp dword [eax + 0x1c], edi
je 0x46eb6c
push 0x208
lea ecx, [esp + 0x2106]
push edi
push ecx
mov word [esp + 0x210c], di
call fcn.0047b0b0
add esp, 0xc
push 0x208
lea edx, [esp + 0x2526]
push edi
push edx
mov word [esp + 0x252c], di
call fcn.0047b0b0
add esp, 0xc
cmp dword [0x48ba20], edi
jne 0x46e9ca
mov ebx, str.shell32.dll
call fcn.004651a0
cmp eax, edi
mov dword [0x48ba20], eax
je 0x46e9ca
push str.SHGetSpecialFolderPathW
push eax
call dword [0x47c188]
mov dword [0x48ba1c], eax
cmp dword [0x48ba1c], edi
je 0x46ea33
cmp dword [0x48b90c], edi
jne 0x46e9ef
push 0x48b908
mov dword [0x48b908], 0x114
call dword [0x47c0c0]
push edi
push 0x1c
lea eax, [esp + 0x2528]
push eax
push edi
call dword [0x48ba1c]
jmp 0x46ead5
mov ecx, dword [ecx + 4]
cmp ecx, edi
jl 0x46ea2c
cmp ecx, dword [0x48bbf4]
jge 0x46ea2c
mov edx, dword [0x48bbe4]
mov eax, dword [edx + ecx*4]
mov ecx, dword [0x48bbe8]
lea eax, [ecx + eax*2]
jmp 0x46e8f9
xor eax, eax
jmp 0x46e8f9
push 0x206
lea ecx, [esp + 0x66]
push edi
push ecx
mov word [esp + 0x6c], di
call fcn.0047b0b0
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call ebp
cmp eax, edi
jne 0x46eab4
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x64]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x24]
push edx
push edi
lea eax, [esp + 0x30]
push eax
push ecx
mov dword [esp + 0x30], 0x208
call dword [0x47c008]
test eax, eax
jne 0x46eaa9
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x46eaa4
shr eax, 1
mov word [esp + eax*2 + 0x60], di
jmp 0x46eaa9
mov word [esp + 0x60], di
mov edx, dword [esp + 0x14]
push edx
call dword [section..rdata]
xor eax, eax
jmp 0x46eac0
movzx ecx, word [esp + eax + 0x60]
mov word [esp + eax + 0x2520], cx
add eax, 2
cmp cx, di
jne 0x46eac0
call fcn.00469e60
mov edx, dword [0x48bc04]
xor eax, eax
cmp edx, edi
jle 0x46eb14
mov esi, dword [0x48bbf8]
lea esp, [esp]
cmp eax, edi
jl 0x46eafc
cmp eax, edx
jge 0x46eafc
mov ecx, esi
jmp 0x46eafe
xor ecx, ecx
cmp dword [ecx], 0x1fa
je 0x46ec27
add eax, 1
add esi, 8
cmp eax, edx
jl 0x46eaf0
mov eax, 0x47c484
push 0x104
push eax
lea eax, [esp + 0x2108]
lea ecx, [esp + 0x2528]
call 0x465830
add esp, 8
lea eax, [esp + 0x2100]
push eax
call dword [0x47c0d4]
cmp eax, 0xffffffff
je 0x46eb6c
mov eax, dword [esp + 0x2944]
lea ecx, [esp + 0x2100]
mov dword [eax + 0x1d7c], 0xe
push ecx
add eax, 0x4a4
push eax
call fcn.00413490
mov edx, dword [esp + 0x2944]
mov eax, dword [edx + 0x1d80]
cmp dword [eax], edi
je 0x46efc6
xor edi, edi
push 0x208
lea ecx, [esp + 0x8a6]
push edi
push ecx
mov word [esp + 0x8ac], di
call fcn.0047b0b0
add esp, 0xc
push 0x208
lea edx, [esp + 0x696]
push edi
push edx
mov word [esp + 0x69c], di
call fcn.0047b0b0
add esp, 0xc
cmp dword [0x48ba20], edi
jne 0x46ebeb
mov ebx, str.shell32.dll
call fcn.004651a0
cmp eax, edi
mov dword [0x48ba20], eax
je 0x46ebeb
push str.SHGetSpecialFolderPathW
push eax
call dword [0x47c188]
mov dword [0x48ba1c], eax
cmp dword [0x48ba1c], edi
je 0x46ec53
cmp dword [0x48b90c], edi
jne 0x46ec10
push 0x48b908
mov dword [0x48b908], 0x114
call dword [0x47c0c0]
push edi
push 0x1c
lea eax, [esp + 0x8a8]
push eax
push edi
call dword [0x48ba1c]
jmp 0x46ecf5
mov ecx, dword [ecx + 4]
cmp ecx, edi
jl 0x46ec4c
cmp ecx, dword [0x48bbf4]
jge 0x46ec4c
mov eax, dword [0x48bbe4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [0x48bbe8]
lea eax, [edx + ecx*2]
jmp 0x46eb19
xor eax, eax
jmp 0x46eb19
push 0x206
lea ecx, [esp + 0x66]
push edi
push ecx
mov word [esp + 0x6c], di
call fcn.0047b0b0
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [0x47c014]
cmp eax, edi
jne 0x46ecd8
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x64]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x24]
push edx
push edi
lea eax, [esp + 0x30]
push eax
push ecx
mov dword [esp + 0x30], 0x208
call dword [0x47c008]
test eax, eax
jne 0x46eccd
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x46ecc8
shr eax, 1
mov word [esp + eax*2 + 0x60], di
jmp 0x46eccd
mov word [esp + 0x60], di
mov edx, dword [esp + 0x14]
push edx
call dword [section..rdata]
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [esp + eax + 0x60]
mov word [esp + eax + 0x8a0], cx
add eax, 2
cmp cx, di
jne 0x46ece0
call fcn.00469e60
mov edx, dword [0x48bc04]
xor eax, eax
cmp edx, edi
jle 0x46ed30
mov esi, dword [0x48bbf8]
lea esp, [esp]
cmp eax, edi
jl 0x46ed1c
cmp eax, edx
jge 0x46ed1c
mov ecx, esi
jmp 0x46ed1e
xor ecx, ecx
cmp dword [ecx], 0x1fb
je 0x46ed9c
add eax, 1
add esi, 8
cmp eax, edx
jl 0x46ed10
mov eax, 0x47c484
push 0x104
push eax
lea eax, [esp + 0x698]
lea ecx, [esp + 0x8a8]
call 0x465830
add esp, 8
mov dword [esp + 0xab0], 0xffffffff
mov word [esp + 0xab4], di
mov word [esp + 0x1214], di
mov word [esp + 0xf8c], di
call fcn.00469e60
mov edx, dword [0x48bc04]
xor eax, eax
cmp edx, edi
jle 0x46ede0
mov esi, dword [0x48bbf8]
jmp 0x46ed90
cmp eax, edi
jl 0x46edc8
cmp eax, edx
jge 0x46edc8
mov ecx, esi
jmp 0x46edca
mov ecx, dword [ecx + 4]
cmp ecx, edi
jl 0x46edc1
cmp ecx, dword [0x48bbf4]
jge 0x46edc1
mov eax, dword [0x48bbe4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [0x48bbe8]
lea eax, [edx + ecx*2]
jmp 0x46ed35
xor eax, eax
jmp 0x46ed35
xor ecx, ecx
cmp dword [ecx], 0x1fc
je 0x46ef67
add eax, 1
add esi, 8
cmp eax, edx
jl 0x46ed90
mov edi, 0x47c484
mov eax, dword [esp + 0xab0]
cmp eax, 0xffffffff
je 0x46ee03
push eax
call dword [0x47c0b4]
mov dword [esp + 0xab0], 0xffffffff
lea eax, [esp + 0x690]
lea edx, [eax + 2]
xor ebx, ebx
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x46ee10
sub eax, edx
sar eax, 1
cmp eax, 0x143
jl 0x46ee2b
mov eax, 0x142
lea esi, [eax + eax]
push esi
lea eax, [esp + 0x694]
push eax
lea ecx, [esp + 0x121c]
push ecx
call fcn.0047b0b6
add esp, 0xc
push 0x143
push edi
lea eax, [esp + 0xabc]
lea ecx, [esp + 0x121c]
mov word [esp + esi + 0x121c], bx
call 0x465830
mov edi, dword [esp + 0x294c]
add esp, 8
mov ebp, 0x400
jmp 0x46ee80
mov eax, dword [esp + 0xab0]
cmp eax, 0xffffffff
lea edx, [esp + 0xd3c]
push edx
jne 0x46ef97
lea eax, [esp + 0xab8]
push eax
call dword [0x47c1dc]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [esp + 0xab0], eax
mov esi, ecx
cmp esi, ebx
je 0x46efaf
lea eax, [esp + 0xd68]
push 0x143
push eax
lea eax, [esp + 0xf94]
lea ecx, [esp + 0x121c]
call 0x465830
add esp, 8
cmp esi, ebx
je 0x46efa8
test byte [esp + 0xd3c], 0x10
je 0x46ee80
test dword [esp + 0xd3c], ebp
jne 0x46ee80
lea esi, [esp + 0xd68]
call fcn.004647a0
test eax, eax
jne 0x46ee80
push 0x208
lea ecx, [esp + 0x14a6]
push ebx
push ecx
mov word [esp + 0x14ac], bx
call fcn.0047b0b0
add esp, 0xc
call fcn.00469e60
mov edx, dword [0x48bc04]
xor eax, eax
cmp edx, ebx
jle 0x46f0d2
mov esi, dword [0x48bbf8]
lea ebx, [ebx]
cmp eax, ebx
jl 0x46f0ba
cmp eax, edx
jge 0x46f0ba
mov ecx, esi
jmp 0x46f0bc
mov ecx, dword [ecx + 4]
cmp ecx, edi
jl 0x46ef8e
cmp ecx, dword [0x48bbf4]
jge 0x46ef8e
mov eax, dword [0x48bbe4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [0x48bbe8]
lea eax, [edx + ecx*2]
mov edi, eax
jmp 0x46ede5
xor eax, eax
mov edi, eax
jmp 0x46ede5
push eax
call dword [0x47c0a4]
mov esi, eax
cmp esi, ebx
jne 0x46eebf
mov eax, dword [esp + 0xab0]
cmp eax, 0xffffffff
je 0x46efc6
push eax
call dword [0x47c0b4]
mov dword [esp + 0xab0], 0xffffffff
mov eax, dword [esp + 0x2944]
mov esi, dword [eax + 0x1d80]
xor ebp, ebp
cmp dword [esi + 0xc], ebp
je 0x46f3d8
push 0x208
mov dword [eax + 0x1d7c], 7
lea eax, [esp + 0x696]
push ebp
push eax
mov word [esp + 0x69c], bp
call fcn.0047b0b0
add esp, 0xc
push 0x208
lea ecx, [esp + 0x486]
push ebp
push ecx
mov word [esp + 0x48c], bp
call fcn.0047b0b0
add esp, 0xc
push 0x208
lea edx, [esp + 0x276]
push ebp
push edx
mov word [esp + 0x27c], bp
call fcn.0047b0b0
add esp, 0xc
cmp dword [esi + 0x640], ebp
je 0x46f136
cmp word [esi + 0x644], bp
lea edx, [esi + 0x644]
je 0x46f136
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x46f066
sub eax, esi
sar eax, 1
cmp eax, 0x104
jl 0x46f081
mov eax, 0x103
lea esi, [eax + eax]
push esi
push edx
lea eax, [esp + 0x488]
push eax
call fcn.0047b0b6
mov edi, dword [esp + 0x2950]
add esp, 0xc
push edi
lea ebx, [esp + 0x484]
mov word [esp + esi + 0x484], bp
call fcn.0046de50
mov ecx, ebx
push ecx
jmp 0x46f3d3
xor ecx, ecx
cmp dword [ecx], 0x1fd
je 0x46f10f
add eax, 1
add esi, 8
cmp eax, edx
jl 0x46ef50
mov eax, 0x47c484
push 0x104
push eax
lea eax, [esp + 0x14a8]
lea ecx, [esp + 0xf94]
call 0x465830
add esp, 8
lea edx, [esp + 0x14a0]
push edx
mov dword [edi + 0x1d7c], 0x10
call fcn.0046dfc0
jmp 0x46ee80
mov ecx, dword [ecx + 4]
cmp ecx, ebx
jl 0x46f132
cmp ecx, dword [0x48bbf4]
jge 0x46f132
mov edx, dword [0x48bbe4]
mov eax, dword [edx + ecx*4]
mov ecx, dword [0x48bbe8]
lea eax, [ecx + eax*2]
jmp 0x46f0d7
xor eax, eax
jmp 0x46f0d7
cmp dword [0x48ba20], ebp
jne 0x46f162
mov ebx, str.shell32.dll
call fcn.004651a0
cmp eax, ebp
mov dword [0x48ba20], eax
je 0x46f162
push str.SHGetSpecialFolderPathW
push eax
call dword [0x47c188]
mov dword [0x48ba1c], eax
cmp dword [0x48ba1c], ebp
je 0x46f19e
cmp dword [0x48b90c], ebp
jne 0x46f187
push 0x48b908
mov dword [0x48b908], 0x114
call dword [0x47c0c0]
push ebp
push 0x1c
lea edx, [esp + 0x698]
push edx
push ebp
call dword [0x48ba1c]
jmp 0x46f245
push 0x206
lea eax, [esp + 0x66]
push ebp
push eax
mov word [esp + 0x6c], bp
call fcn.0047b0b0
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push ebp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [0x47c014]
cmp eax, ebp
jne 0x46f223
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x64]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push ecx
push ebp
lea edx, [esp + 0x30]
push edx
push eax
mov dword [esp + 0x30], 0x208
call dword [0x47c008]
test eax, eax
jne 0x46f218
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x46f213
shr eax, 1
mov word [esp + eax*2 + 0x60], bp
jmp 0x46f218
mov word [esp + 0x60], bp
mov ecx, dword [esp + 0x14]
push ecx
call dword [section..rdata]
xor eax, eax
jmp 0x46f230
movzx ecx, word [esp + eax + 0x60]
mov word [esp + eax + 0x690], cx
add eax, 2
cmp cx, bp
jne 0x46f230
call fcn.00469e60
mov edx, dword [0x48bc04]
xor eax, eax
cmp edx, ebp
jle 0x46f280
mov esi, dword [0x48bbf8]
lea esp, [esp]
cmp eax, ebp
jl 0x46f26c
cmp eax, edx
jge 0x46f26c
mov ecx, esi
jmp 0x46f26e
xor ecx, ecx
cmp dword [ecx], 0x1fe
je 0x46f2dc
add eax, 1
add esi, 8
cmp eax, edx
jl 0x46f260
mov eax, 0x47c484
push 0x104
push eax
lea eax, [esp + 0x278]
lea ecx, [esp + 0x698]
call 0x465830
mov edi, dword [esp + 0x294c]
add esp, 8
lea edx, [esp + 0x270]
push edx
call fcn.0046dfc0
call fcn.00469e60
mov edx, dword [0x48bc04]
xor eax, eax
cmp edx, ebp
jle 0x46f317
mov esi, dword [0x48bbf8]
lea esp, [esp]
cmp eax, ebp
jl 0x46f303
cmp eax, edx
jge 0x46f303
mov ecx, esi
jmp 0x46f305
mov ecx, dword [ecx + 4]
cmp ecx, ebp
jl 0x46f2ff
cmp ecx, dword [0x48bbf4]
jge 0x46f2ff
mov edx, dword [0x48bbe4]
mov eax, dword [edx + ecx*4]
mov ecx, dword [0x48bbe8]
lea eax, [ecx + eax*2]
jmp 0x46f285
xor eax, eax
jmp 0x46f285
xor ecx, ecx
cmp dword [ecx], 0x1ff
je 0x46f36c
add eax, 1
add esi, 8
cmp eax, edx
jl 0x46f2d0
mov eax, 0x47c484
push 0x104
push eax
lea eax, [esp + 0x278]
lea ecx, [esp + 0x698]
call 0x465830
add esp, 8
lea eax, [esp + 0x270]
push eax
call fcn.0046dfc0
call fcn.00469e60
mov edx, dword [0x48bc04]
xor eax, eax
cmp edx, ebp
jle 0x46f3aa
mov esi, dword [0x48bbf8]
lea esp, [esp]
cmp eax, ebp
jl 0x46f392
cmp eax, edx
jge 0x46f392
mov ecx, esi
jmp 0x46f394
mov ecx, dword [ecx + 4]
cmp ecx, ebp
jl 0x46f38e
cmp ecx, dword [0x48bbf4]
jge 0x46f38e
mov eax, dword [0x48bbe4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [0x48bbe8]
lea eax, [edx + ecx*2]
jmp 0x46f31c
xor eax, eax
jmp 0x46f31c
xor ecx, ecx
cmp dword [ecx], 0x200
je 0x46f42f
add eax, 1
add esi, 8
cmp eax, edx
jl 0x46f360
mov eax, 0x47c484
push 0x104
push eax
lea eax, [esp + 0x278]
lea ecx, [esp + 0x698]
call 0x465830
add esp, 8
lea edx, [esp + 0x270]
push edx
call fcn.0046dfc0
mov eax, dword [esp + 0x2944]
mov ecx, dword [eax + 0x1d80]
cmp dword [ecx + 0x10], ebp
je 0x46f45c
push 0x208
lea edx, [esp + 0x66]
push ebp
push edx
mov word [esp + 0x6c], bp
call fcn.0047b0b0
add esp, 0xc
lea edi, [esp + 0x60]
call fcn.004144f0
cmp word [esp + 0x60], bp
mov ebx, dword [esp + 0x2944]
je 0x46f45e
mov eax, dword [ebx + 0x1cdc]
mov eax, dword [eax + 0x14]
lea ecx, [ebx + 0x1cdc]
mov edx, edi
push edx
call eax
jmp 0x46f45e
mov ecx, dword [ecx + 4]
cmp ecx, ebp
jl 0x46f455
cmp ecx, dword [0x48bbf4]
jge 0x46f455
mov edx, dword [0x48bbe4]
mov eax, dword [edx + ecx*4]
mov ecx, dword [0x48bbe8]
lea eax, [ecx + eax*2]
jmp 0x46f3af
xor eax, eax
jmp 0x46f3af
mov ebx, eax
mov eax, dword [ebx + 0x1d80]
cmp dword [eax + 8], ebp
je 0x46fbd3
mov dword [ebx + 0x1d7c], 8
cmp dword [eax + 0x850], ebp
je 0x46f569
lea ecx, [eax + 0x854]
movzx eax, word [ecx]
cmp ax, bp
mov edi, ecx
je 0x46f4ae
cmp ax, 0x5c
je 0x46f49f
cmp ax, 0x2f
jne 0x46f4a2
lea edi, [ecx + 2]
movzx eax, word [ecx + 2]
add ecx, 2
cmp ax, bp
jne 0x46f493
call fcn.00469e60
mov edx, dword [0x48bc04]
xor eax, eax
cmp edx, ebp
jle 0x46f4e5
mov esi, dword [0x48bbf8]
cmp eax, ebp
jl 0x46f4d1
cmp eax, edx
jge 0x46f4d1
mov ecx, esi
jmp 0x46f4d3
xor ecx, ecx
cmp dword [ecx], 0x201
je 0x46f51e
add eax, 1
add esi, 8
cmp eax, edx
jl 0x46f4c5
mov eax, 0x47c484
push eax
push edi
call fcn.00401a28
add esp, 8
test eax, eax
jne 0x46f545
mov edx, dword [ebx + 0x1d80]
add edx, 0x854
push edx
add ebx, 0x4a4
push ebx
call fcn.00413490
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2930
ret 4
mov ecx, dword [ecx + 4]
cmp ecx, ebp
jl 0x46f541
cmp ecx, dword [0x48bbf4]
jge 0x46f541
mov edx, dword [0x48bbe4]
mov eax, dword [edx + ecx*4]
mov ecx, dword [0x48bbe8]
lea eax, [ecx + eax*2]
jmp 0x46f4ea
xor eax, eax
jmp 0x46f4ea
mov eax, dword [ebx + 0x1d80]
add ebx, 0x4cc
add eax, 0x854
push ebx
call fcn.0040fe60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2930
ret 4
push 0x208
lea eax, [esp + 0x486]
push ebp
push eax
mov word [esp + 0x48c], bp
call fcn.0047b0b0
add esp, 0xc
push 0x208
lea ecx, [esp + 0x276]
push ebp
push ecx
mov word [esp + 0x27c], bp
call fcn.0047b0b0
add esp, 0xc
push 0x208
lea edx, [esp + 0x14a6]
push ebp
push edx
mov word [esp + 0x14ac], bp
call fcn.0047b0b0
add esp, 0xc
cmp dword [0x48ba20], ebp
jne 0x46f5ef
mov ebx, str.shell32.dll
call fcn.004651a0
cmp eax, ebp
mov dword [0x48ba20], eax
je 0x46f5ef
push str.SHGetSpecialFolderPathW
push eax
call dword [0x47c188]
mov dword [0x48ba1c], eax
cmp dword [0x48ba1c], ebp
je 0x46f62b
cmp dword [0x48b90c], ebp
jne 0x46f614
push 0x48b908
mov dword [0x48b908], 0x114
call dword [0x47c0c0]
push ebp
push 0x1a
lea eax, [esp + 0x488]
push eax
push ebp
call dword [0x48ba1c]
jmp 0x46f6f5
push 0x206
lea ecx, [esp + 0x66]
push ebp
push ecx
mov word [esp + 0x6c], bp
call fcn.0047b0b0
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push 0x20019
push ebp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [0x47c014]
cmp eax, ebp
jne 0x46f6d2
xor eax, eax
jmp 0x46f670
movzx ecx, word [eax + str.AppData]
mov word [esp + eax + 0x20], cx
add eax, 2
cmp cx, bp
jne 0x46f670
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x64]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x24]
push edx
push ebp
lea eax, [esp + 0x30]
push eax
push ecx
mov dword [esp + 0x30], 0x208
call dword [0x47c008]
test eax, eax
jne 0x46f6c7
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x46f6c2
shr eax, 1
mov word [esp + eax*2 + 0x60], bp
jmp 0x46f6c7
mov word [esp + 0x60], bp
mov edx, dword [esp + 0x14]
push edx
call dword [section..rdata]
xor eax, eax
jmp 0x46f6e0
movzx ecx, word [esp + eax + 0x60]
mov word [esp + eax + 0x480], cx
add eax, 2
cmp cx, bp
jne 0x46f6e0
call fcn.00469e60
mov edx, dword [0x48bc04]
xor eax, eax
cmp edx, ebp
jle 0x46f730
mov esi, dword [0x48bbf8]
lea esp, [esp]
cmp eax, ebp
jl 0x46f71c
cmp eax, edx
jge 0x46f71c
mov ecx, esi
jmp 0x46f71e
xor ecx, ecx
cmp dword [ecx], 0x202
je 0x46f770
add eax, 1
add esi, 8
cmp eax, edx
jl 0x46f710
mov eax, 0x47c484
push 0x104
push eax
lea eax, [esp + 0x278]
lea ecx, [esp + 0x488]
call 0x465830
mov edi, dword [0x47c0d4]
add esp, 8
lea eax, [esp + 0x270]
push eax
call edi
cmp eax, 0xffffffff
jne 0x46f796
mov word [esp + 0x270], bp
jmp 0x46f7a4
mov ecx, dword [ecx + 4]
cmp ecx, ebp
jl 0x46f792
cmp ecx, dword [0x48bbf4]
jge 0x46f792
mov eax, dword [0x48bbe4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [0x48bbe8]
lea eax, [edx + ecx*2]
jmp 0x46f735
xor eax, eax
jmp 0x46f735
cmp word [esp + 0x270], bp
jne 0x46f898
call fcn.00469e60
mov edx, dword [0x48bc04]
xor eax, eax
cmp edx, ebp
jle 0x46f7e4
mov esi, dword [0x48bbf8]
jmp 0x46f7c0
cmp eax, ebp
jl 0x46f7cc
cmp eax, edx
jge 0x46f7cc
mov ecx, esi
jmp 0x46f7ce
xor ecx, ecx
cmp dword [ecx], 0x203
je 0x46f861
add eax, 1
add esi, 8
cmp eax, edx
jl 0x46f7c0
mov eax, 0x47c484
push 0x104
push eax
lea eax, [esp + 0x278]
lea ecx, [esp + 0x488]
call 0x465830
add esp, 8
lea edx, [esp + 0x270]
push edx
call edi
cmp eax, 0xffffffff
jne 0x46f88e
mov word [esp + 0x270], bp
push 0x208
lea ecx, [esp + 0x8a6]
push ebp
push ecx
mov word [esp + 0x8ac], bp
call fcn.0047b0b0
add esp, 0xc
call fcn.00469e60
mov edx, dword [0x48bc04]
xor eax, eax
cmp edx, ebp
jle 0x46f8ce
mov esi, dword [0x48bbf8]
cmp eax, ebp
jl 0x46f8b6
cmp eax, edx
jge 0x46f8b6
mov ecx, esi
jmp 0x46f8b8
mov ecx, dword [ecx + 4]
cmp ecx, ebp
jl 0x46f887
cmp ecx, dword [0x48bbf4]
jge 0x46f887
mov edx, dword [0x48bbe4]
mov eax, dword [edx + ecx*4]
mov ecx, dword [0x48bbe8]
lea eax, [ecx + eax*2]
jmp 0x46f7e9
xor eax, eax
jmp 0x46f7e9
cmp word [esp + 0x270], bp
je 0x46f81c
mov eax, dword [esp + 0x2944]
add eax, 0x4cc
push eax
lea eax, [esp + 0x274]
call fcn.0040fe60
jmp 0x46faa4
xor ecx, ecx
cmp dword [ecx], 0x204
je 0x46fa4f
add eax, 1
add esi, 8
cmp eax, edx
jl 0x46f855
mov eax, 0x47c484
push 0x104
push eax
lea eax, [esp + 0x8a8]
lea ecx, [esp + 0x488]
call 0x465830
lea eax, [esp + 0x8a8]
add esp, 8
mov dword [esp + 0xab0], 0xffffffff
mov word [esp + 0xab4], bp
mov word [esp + 0x1214], bp
mov word [esp + 0xf8c], bp
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x46f920
sub eax, edx
sar eax, 1
cmp eax, 0x143
jl 0x46f93b
mov eax, 0x142
lea esi, [eax + eax]
push esi
lea edx, [esp + 0x8a4]
push edx
lea eax, [esp + 0x121c]
push eax
call fcn.0047b0b6
add esp, 0xc
push 0x143
push 0x47cea4
lea eax, [esp + 0xabc]
lea ecx, [esp + 0x121c]
mov word [esp + esi + 0x121c], bp
call 0x465830
mov edi, dword [0x47c1dc]
mov ebx, dword [0x47c0a4]
add esp, 8
mov ebp, 0x400
mov eax, dword [esp + 0xab0]
cmp eax, 0xffffffff
jne 0x46fa7c
lea ecx, [esp + 0xd3c]
push ecx
lea edx, [esp + 0xab8]
push edx
call edi
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [esp + 0xab0], eax
mov esi, ecx
test esi, esi
je 0x46fa98
lea eax, [esp + 0xd68]
push 0x143
push eax
lea eax, [esp + 0xf94]
lea ecx, [esp + 0x121c]
call 0x465830
add esp, 8
test esi, esi
je 0x46fa91
test byte [esp + 0xd3c], 0x10
je 0x46f990
test dword [esp + 0xd3c], ebp
jne 0x46f990
lea esi, [esp + 0xd68]
call fcn.004647a0
test eax, eax
jne 0x46f990
call fcn.00469e60
mov edx, dword [0x48bc04]
xor eax, eax
test edx, edx
jle 0x46faef
mov esi, dword [0x48bbf8]
test eax, eax
jl 0x46fad7
cmp eax, edx
jge 0x46fad7
mov ecx, esi
jmp 0x46fad9
mov ecx, dword [ecx + 4]
cmp ecx, ebp
jl 0x46fa75
cmp ecx, dword [0x48bbf4]
jge 0x46fa75
mov edx, dword [0x48bbe4]
mov eax, dword [edx + ecx*4]
mov ecx, dword [0x48bbe8]
lea eax, [ecx + eax*2]
jmp 0x46f8d3
xor eax, eax
jmp 0x46f8d3
lea edx, [esp + 0xd3c]
push edx
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x46f9cb
mov eax, dword [esp + 0xab0]
cmp eax, 0xffffffff
je 0x46faa4
push eax
call dword [0x47c0b4]
call fcn.00469e60
mov edx, dword [0x48bc04]
xor eax, eax
test edx, edx
jle 0x46fb84
mov esi, dword [0x48bbf8]
nop
test eax, eax
jl 0x46fb6c
cmp eax, edx
jge 0x46fb6c
mov ecx, esi
jmp 0x46fb6e
xor ecx, ecx
cmp dword [ecx], 0x205
je 0x46fb45
add eax, 1
add esi, 8
cmp eax, edx
jl 0x46fa38
mov eax, 0x47c484
push 0x104
push eax
lea eax, [esp + 0x278]
lea ecx, [esp + 0xf94]
call 0x465830
add esp, 8
lea edx, [esp + 0x270]
push edx
call dword [0x47c0d4]
cmp eax, 0xffffffff
je 0x46f990
mov eax, dword [esp + 0x2944]
add eax, 0x4cc
push eax
lea eax, [esp + 0x274]
call fcn.0040fe60
jmp 0x46f990
mov ecx, dword [ecx + 4]
test ecx, ecx
jl 0x46fb68
cmp ecx, dword [0x48bbf4]
jge 0x46fb68
mov edx, dword [0x48bbe4]
mov eax, dword [edx + ecx*4]
mov ecx, dword [0x48bbe8]
lea eax, [ecx + eax*2]
jmp 0x46faf4
xor eax, eax
jmp 0x46faf4
xor ecx, ecx
cmp dword [ecx], 0x206
je 0x46fbe0
add eax, 1
add esi, 8
cmp eax, edx
jl 0x46fac0
mov eax, 0x47c484
push 0x104
push eax
lea eax, [esp + 0x14a8]
lea ecx, [esp + 0x488]
call 0x465830
add esp, 8
lea edx, [esp + 0x14a0]
push edx
call dword [0x47c0d4]
cmp eax, 0xffffffff
je 0x46fbd3
mov ecx, dword [esp + 0x2944]
lea eax, [esp + 0x14a0]
push eax
add ecx, 0x4a4
push ecx
call fcn.00413490
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2930
ret 4
mov ecx, dword [ecx + 4]
test ecx, ecx
jl 0x46fc03
cmp ecx, dword [0x48bbf4]
jge 0x46fc03
mov edx, dword [0x48bbe4]
mov eax, dword [edx + ecx*4]
mov ecx, dword [0x48bbe8]
lea eax, [ecx + eax*2]
jmp 0x46fb89
xor eax, eax
jmp 0x46fb89