Function at 0x47b640
Capabilities:
Check if file exists
Encrypt data using rc4 prga
Get file attributes

Disassembly:
sub esp, 0x238
push ebx
push ebp
mov ebp, dword [esp + 0x244]
push esi
mov esi, edx
push edi
cmp ebp, 1
je 0x47b662
mov byte [esp + 0x13], 0
cmp ebp, 2
jne 0x47b667
mov byte [esp + 0x13], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x3c]
push eax
push 0x104
push ecx
call edi
lea ecx, [esp + 0x38]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47b686
sub ecx, edx
je 0x47b69c
cmp byte [esp + ecx + 0x37], 0x5c
jne 0x47b69c
mov byte [esp + ecx + 0x37], al
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x144]
push eax
push 0x104
push esi
call edi
lea ecx, [esp + 0x140]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47b6c0
sub ecx, edx
je 0x47b6dc
cmp byte [esp + ecx + 0x13f], 0x5c
jne 0x47b6dc
mov byte [esp + ecx + 0x13f], al
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea eax, [esp + 0x38]
push eax
call edi
cmp eax, 0xffffffff
je 0x47b89b
test al, 0x10
je 0x47b89b
mov bl, byte [esp + 0x250]
test bl, bl
je 0x47b79b
movzx ebx, byte [esp + 0x38]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
test ebx, 0xffffff80
jne 0x47b72b
push 1
push ebx
call esi
add esp, 8
test eax, eax
je 0x47b72b
or ebx, 0x20
mov dword [esp + 0x14], ebx
movzx ebx, byte [esp + 0x140]
test ebx, 0xffffff80
jne 0x47b74e
push 1
push ebx
call esi
add esp, 8
test eax, eax
je 0x47b74e
or ebx, 0x20
cmp byte [esp + 0x14], bl
jne 0x47b75b
cmp byte [esp + 0x39], 0x3a
je 0x47b794
movzx eax, byte [esp + 0x13]
lea edx, [esp + 0x140]
push 0
push eax
lea ecx, [esp + 0x40]
call fcn.0047b640
add esp, 8
test al, al
je 0x47b89b
mov dl, 1
lea ecx, [esp + 0x38]
call fcn.0047b8b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x238
ret
mov bl, byte [esp + 0x250]
lea eax, [esp + 0x140]
push eax
call edi
cmp eax, 0xffffffff
je 0x47b7c4
test al, 0x10
je 0x47b89b
mov al, byte [esp + 0x13]
test al, al
je 0x47b89b
test bl, bl
jne 0x47b7fc
jmp 0x47b7de
test bl, bl
jne 0x47b7fc
xor edx, edx
lea ecx, [esp + 0x140]
call fcn.004620a0
test al, al
je 0x47b89b
lea ecx, [esp + 0x38]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x47b7e3
mov eax, dword [0x4ceca0]
mov dword [ecx], eax
mov al, byte [0x4ceca4]
mov byte [ecx + 4], al
lea ecx, [esp + 0x38]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47b803
sub ecx, edx
mov byte [esp + ecx + 0x39], al
lea ecx, [esp + 0x140]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47b820
sub ecx, edx
mov dword [esp + 0x18], 0
xorps xmm0, xmm0
mov dword [esp + 0x32], 0
movlpd qword [esp + 0x2a], xmm0
mov byte [esp + ecx + 0x141], al
lea eax, [esp + 0x38]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x140]
mov dword [esp + 0x24], eax
movzx eax, bl
xor eax, 1
inc eax
mov dword [esp + 0x1c], eax
mov eax, 0x614
mov word [esp + 0x28], ax
cmp ebp, 2
jne 0x47b880
mov eax, 0x615
mov word [esp + 0x28], ax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
pop edi
pop esi
test eax, eax
pop ebp
sete al
pop ebx
add esp, 0x238
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x238
ret