Function at 0x4a6b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x5d4872
mov eax, dword fs:[0]
push eax
sub esp, 0x98
push ebx
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0xa4]
mov dword fs:[0], eax
mov edi, dword [esp + 0xb4]
push edi
call fcn.0041d3b0
mov dword [esp + 0xac], 0
lea eax, [esp + 0x94]
push eax
mov ecx, str._APPDATA_
mov byte [esp + 0x94], 1
call fcn.0040b8a0
mov byte [esp + 0xac], 2
lea ebx, [esp + 0x90]
call fcn.004a7120
mov byte [esp + 0xac], 0
lea ecx, [esp + 0x94]
call fcn.0040b950
lea ecx, [esp + 0x24]
push ecx
mov ecx, str._PROGRAMFILES_
mov byte [esp + 0x24], 2
call fcn.0040b8a0
mov byte [esp + 0xac], 5
lea ebx, [esp + 0x20]
call fcn.004a7120
mov byte [esp + 0xac], 0
lea ecx, [esp + 0x24]
call fcn.0040b950
lea edx, [esp + 0x64]
push edx
mov ecx, str._SYSDIR_
mov byte [esp + 0x64], 3
call fcn.0040b8a0
mov byte [esp + 0xac], 8
lea ebx, [esp + 0x60]
call fcn.004a7120
mov byte [esp + 0xac], 0
lea ecx, [esp + 0x64]
call fcn.0040b950
lea eax, [esp + 0x34]
push eax
mov ecx, str._STARTMENU_
mov byte [esp + 0x34], 4
call fcn.0040b8a0
mov byte [esp + 0xac], 0xb
lea ebx, [esp + 0x30]
call fcn.004a7120
mov byte [esp + 0xac], 0
lea ecx, [esp + 0x34]
call fcn.0040b950
lea ecx, [esp + 0x84]
push ecx
mov ecx, str._COMMONFILES_
mov byte [esp + 0x84], 5
call fcn.0040b8a0
mov byte [esp + 0xac], 0xe
lea ebx, [esp + 0x80]
call fcn.004a7120
mov byte [esp + 0xac], 0
lea ecx, [esp + 0x84]
call fcn.0040b950
lea edx, [esp + 0x44]
push edx
mov ecx, str._DESKTOP_
mov byte [esp + 0x44], 6
call fcn.0040b8a0
mov byte [esp + 0xac], 0x11
lea ebx, [esp + 0x40]
call fcn.004a7120
mov byte [esp + 0xac], 0
lea ecx, [esp + 0x44]
call fcn.0040b950
lea eax, [esp + 0x74]
push eax
mov ecx, str._STARTUP_
mov byte [esp + 0x74], 7
call fcn.0040b8a0
mov byte [esp + 0xac], 0x14
lea ebx, [esp + 0x70]
call fcn.004a7120
mov byte [esp + 0xac], 0
lea ecx, [esp + 0x74]
call fcn.0040b950
lea ecx, [esp + 0x54]
push ecx
mov ecx, str._MYDOCS_
mov byte [esp + 0x54], 8
call fcn.0040b8a0
mov byte [esp + 0xac], 0x17
lea ebx, [esp + 0x50]
call fcn.004a7120
mov byte [esp + 0xac], 0
lea ecx, [esp + 0x54]
call fcn.0040b950
lea edx, [esp + 0x14]
push edx
mov ecx, str._PROGRAMS_
mov byte [esp + 0x14], 9
call fcn.0040b8a0
mov byte [esp + 0xac], 0x1a
lea ebx, [esp + 0x10]
call fcn.004a7120
mov byte [esp + 0xac], 0
lea ecx, [esp + 0x14]
call fcn.0040b950
lea eax, [esp + 0x1c]
push eax
mov ecx, str._TEMP_
mov byte [esp + 0x1c], 0xa
call fcn.0040b8a0
mov byte [esp + 0xac], 0x1d
lea ebx, [esp + 0x18]
call fcn.004a7120
mov byte [esp + 0xac], 0
lea ecx, [esp + 0x1c]
call fcn.0040b950
lea ecx, [esp + 0x2c]
push ecx
mov ecx, str._WINDIR_
mov byte [esp + 0x2c], 0xb
call fcn.0040b8a0
mov byte [esp + 0xac], 0x20
lea ebx, [esp + 0x28]
call fcn.004a7120
mov byte [esp + 0xac], 0
lea ecx, [esp + 0x2c]
call fcn.0040b950
lea edx, [esp + 0x3c]
mov byte [esp + 0x38], 0xc
push edx
mov ecx, str._LOCALAPPDATA_
call fcn.0040b8a0
mov byte [esp + 0xac], 0x23
lea ebx, [esp + 0x38]
call fcn.004a7120
mov byte [esp + 0xac], 0
lea ecx, [esp + 0x3c]
call fcn.0040b950
lea eax, [esp + 0x4c]
push eax
mov ecx, str._QUICKLAUNCH_
mov byte [esp + 0x4c], 0xd
call fcn.0040b8a0
mov byte [esp + 0xac], 0x26
lea ebx, [esp + 0x48]
call fcn.004a7120
mov byte [esp + 0xac], 0
lea ecx, [esp + 0x4c]
call fcn.0040b950
lea ecx, [esp + 0x5c]
push ecx
mov ecx, str._FAVORITES_
mov byte [esp + 0x5c], 0xe
call fcn.0040b8a0
mov byte [esp + 0xac], 0x29
lea ebx, [esp + 0x58]
call fcn.004a7120
mov byte [esp + 0xac], 0
lea ecx, [esp + 0x5c]
call fcn.0040b950
lea edx, [esp + 0x6c]
push edx
mov ecx, str._USERROOT_
mov byte [esp + 0x6c], 0xf
call fcn.0040b8a0
mov byte [esp + 0xac], 0x2c
lea ebx, [esp + 0x68]
call fcn.004a7120
mov byte [esp + 0xac], 0
lea ecx, [esp + 0x6c]
call fcn.0040b950
lea eax, [esp + 0x7c]
push eax
mov ecx, str._FFPROFILE_
mov byte [esp + 0x7c], 0x10
call fcn.0040b8a0
mov byte [esp + 0xac], 0x2f
lea ebx, [esp + 0x78]
call fcn.004a7120
mov byte [esp + 0xac], 0
lea ecx, [esp + 0x7c]
call fcn.0040b950
lea ecx, [esp + 0x8c]
push ecx
mov ecx, str._ROOTDRIVE_
mov byte [esp + 0x8c], 0x11
call fcn.0040b8a0
mov byte [esp + 0xac], 0x32
lea ebx, [esp + 0x88]
call fcn.004a7120
mov byte [esp + 0xac], 0
lea ecx, [esp + 0x8c]
call fcn.0040b950
mov byte [esp + 0x98], 0x12
lea edx, [esp + 0x9c]
push edx
mov ecx, str._GCE_
call fcn.0040b8a0
mov byte [esp + 0xac], 0x35
lea ebx, [esp + 0x98]
call fcn.004a7120
mov byte [esp + 0xac], 0
lea ecx, [esp + 0x9c]
call fcn.0040b950
mov dword [esp + 0xac], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0xa4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0xa4
ret 4