Function at 0x46d3a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1294
call fcn.0047aea0
push ebx
mov ebx, dword [esp + 0x12a0]
push ebp
mov ebp, dword [esp + 0x12a0]
push esi
push edi
lea eax, [ebx + 0x650]
push eax
push str.Scanning_user_profile:__s
call fcn.00460220
push 0x2a50
lea ecx, [ebp + 0x34a8]
push ebx
push ecx
call sub.msvcrt.dll_memcpy
xor eax, eax
add esp, 0x14
lea edx, [ebp + 0x1494]
mov dword [0x48d48c], eax
mov dword [0x48d474], eax
push edx
mov eax, 0x48d470
call fcn.004665d0
lea eax, [ebx + 0x1a50]
push eax
mov eax, 0x48d470
call fcn.004665d0
mov edi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov eax, 1
lea esi, [ebx + 0x2250]
push esi
mov dword [ebp + 0x5efc], eax
mov dword [ebp + 0x5ef8], eax
call edi
cmp eax, 0xffffffff
je 0x46d43f
push 0
push esi
mov ecx, ebp
call fcn.00476150
lea esi, [ebx + 0x2650]
push esi
call edi
cmp eax, 0xffffffff
je 0x46d457
push 0
push esi
mov ecx, ebp
call fcn.00476150
cmp dword [0x48cf90], 0
jne 0x46d877
mov eax, dword [0x48cf80]
test eax, eax
je 0x46d49e
cmp eax, 1
push str.Scanning_Firefox_and_other_Mozilla_Web_browsers
push 0
jne 0x46d496
mov ecx, dword [0x48cf7c]
mov edx, dword [ecx]
push 0x44b
push edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x46d49e
call fcn.0045fff0
add esp, 8
push 0x1f
mov esi, 0xa
push ebp
mov ecx, str.MozillaFirefox
mov edx, ebx
mov dword [ebp + 0x5efc], esi
call fcn.0046ce20
cmp dword [0x48cf90], 0
jne 0x46d877
push 0x20
push ebp
mov ecx, str.MozillaSeaMonkey
mov edx, ebx
call fcn.0046ce20
cmp dword [0x48cf90], 0
jne 0x46d877
push 0x22
push ebp
mov ecx, str.Waterfox
mov edx, ebx
call fcn.0046ce20
cmp dword [0x48cf90], 0
jne 0x46d877
push 0x21
push ebp
mov ecx, str.Moonchild_ProductionsPale_Moon
mov edx, ebx
call fcn.0046ce20
cmp dword [0x48cf90], 0
jne 0x46d877
mov ecx, str.Scanning_Thunderbird
call fcn.004602c0
push 0x38
push ebp
mov ecx, str.Thunderbird
mov edx, ebx
call fcn.0046ce20
cmp dword [0x48cf90], 0
jne 0x46d877
push 0x3fe
lea eax, [esp + 0x4e]
push 0
push eax
mov word [esp + 0x54], 0
call sub.msvcrt.dll_memset
add esp, 0xc
mov ecx, str.Scanning_Chromium_based_Web_browsers
call fcn.004602c0
mov dword [ebp + 0x5efc], esi
lea esi, [ebx + 0x1250]
push 0x104
push str.GoogleChromeUser_Data
lea eax, [esp + 0x50]
mov ecx, esi
mov dword [ebp + 0x5ef8], 0xb
call fcn.00468830
add esp, 8
lea edi, [ebp + 0xb70]
lea ecx, [esp + 0x48]
call fcn.00477a60
cmp dword [0x48cf90], 0
jne 0x46d877
push 0x104
push str.GoogleChrome_SxSUser_Data
lea eax, [esp + 0x50]
mov ecx, esi
mov dword [ebp + 0x5ef8], 0xc
call fcn.00468830
add esp, 8
lea ecx, [esp + 0x48]
call fcn.00477a60
cmp dword [0x48cf90], 0
jne 0x46d877
push 0x104
push str.ChromiumUser_Data
lea eax, [esp + 0x50]
mov ecx, esi
mov dword [ebp + 0x5ef8], 0xd
call fcn.00468830
add esp, 8
lea ecx, [esp + 0x48]
call fcn.00477a60
cmp dword [0x48cf90], 0
jne 0x46d877
push 0x104
push str.VivaldiUser_Data
lea eax, [esp + 0x50]
mov ecx, esi
mov dword [ebp + 0x5ef8], 0xf
call fcn.00468830
add esp, 8
lea ecx, [esp + 0x48]
call fcn.00477a60
cmp dword [0x48cf90], 0
jne 0x46d877
push 0x104
push str.YandexYandexBrowserUser_Data
lea eax, [esp + 0x50]
mov ecx, esi
mov dword [ebp + 0x5ef8], 0x10
call fcn.00468830
add esp, 8
lea ecx, [esp + 0x48]
call fcn.00477a60
cmp dword [0x48cf90], 0
jne 0x46d877
push 0x104
push str.BraveSoftwareBrave_BrowserUser_Data
lea eax, [esp + 0x50]
mov ecx, esi
mov dword [ebp + 0x5ef8], 0x12
call fcn.00468830
add esp, 8
lea ecx, [esp + 0x48]
call fcn.00477a60
cmp dword [0x48cf90], 0
jne 0x46d877
push 0x104
push str.Opera_Software
lea ecx, [ebx + 0xe50]
lea eax, [esp + 0x50]
mov dword [ebp + 0x5ef8], 0xe
call fcn.00468830
add esp, 8
lea ecx, [esp + 0x48]
call fcn.00477a60
push 0x3fe
lea ecx, [esp + 0x4e]
push 0
push ecx
mov word [esp + 0x54], 0
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
push str.Microsoft
lea eax, [esp + 0x50]
mov ecx, esi
call fcn.00468830
add esp, 8
lea eax, [esp + 0x448]
mov dword [ebp + 0x5ef8], 0x11
call fcn.00466000
lea edx, [esp + 0x48]
push edx
push str.Edge
mov ebx, eax
call fcn.00466830
mov esi, ebx
call fcn.00466780
test eax, eax
je 0x46d7de
mov edi, edi
lea ecx, [esp + 0x448]
call fcn.00466440
test eax, eax
je 0x46d7ce
cmp dword [0x48cf90], 0
jne 0x46d86b
push 0x208
lea eax, [esp + 0x4e]
push 0
push eax
mov word [esp + 0x54], 0
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
push str.User_Data
lea eax, [esp + 0x50]
lea ecx, [esp + 0xaa8]
call fcn.00468830
add esp, 8
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46d7ce
lea ecx, [esp + 0x48]
call fcn.00477a60
lea esi, [esp + 0x448]
call fcn.00466780
test eax, eax
jne 0x46d760
mov ebx, dword [esp + 0x12ac]
lea edx, [ebx + 0xa50]
lea esi, [ebp + 0x1080]
push edx
call fcn.00458760
xor edi, edi
cmp eax, edi
mov dword [ebp + 0x1090], eax
je 0x46d846
mov ecx, str.Scanning_Outlook_accounts
call fcn.004602c0
lea eax, [esp + 0x14]
call fcn.00458970
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x1c], esi
lea edi, [ebp + 0xb98]
mov esi, eax
mov dword [esp + 0x18], 0x20
mov dword [ebp + 0x5ef8], 0x33
call fcn.0045be20
call fcn.00458910
cmp dword [0x48cf90], 0
jne 0x46d86b
mov ecx, str.Scanning_Windows_Vault
call fcn.004602c0
add ebx, 0x1e50
push ebx
lea ecx, [ebp + 0xf7c]
call fcn.00409010
lea esi, [esp + 0x448]
call fcn.00465fe0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1294
ret 8