Function at 0x46d490
Capabilities:
Check if file exists
Encrypt data using rc4 prga
Get file attributes

Disassembly:
sub esp, 0x238
push ebx
push ebp
mov ebp, dword [esp + 0x244]
push esi
mov esi, edx
push edi
cmp ebp, 1
je 0x46d4b2
mov byte [esp + 0x13], 0
cmp ebp, 2
jne 0x46d4b7
mov byte [esp + 0x13], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x3c]
push eax
push 0x104
push ecx
call edi
lea ecx, [esp + 0x38]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d4d6
sub ecx, edx
je 0x46d4ec
cmp byte [esp + ecx + 0x37], 0x5c
jne 0x46d4ec
mov byte [esp + ecx + 0x37], al
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x144]
push eax
push 0x104
push esi
call edi
lea ecx, [esp + 0x140]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d510
sub ecx, edx
je 0x46d52c
cmp byte [esp + ecx + 0x13f], 0x5c
jne 0x46d52c
mov byte [esp + ecx + 0x13f], al
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea eax, [esp + 0x38]
push eax
call edi
cmp eax, 0xffffffff
je 0x46d6eb
test al, 0x10
je 0x46d6eb
mov bl, byte [esp + 0x250]
test bl, bl
je 0x46d5eb
movzx ebx, byte [esp + 0x38]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
test ebx, 0xffffff80
jne 0x46d57b
push 1
push ebx
call esi
add esp, 8
test eax, eax
je 0x46d57b
or ebx, 0x20
mov dword [esp + 0x14], ebx
movzx ebx, byte [esp + 0x140]
test ebx, 0xffffff80
jne 0x46d59e
push 1
push ebx
call esi
add esp, 8
test eax, eax
je 0x46d59e
or ebx, 0x20
cmp byte [esp + 0x14], bl
jne 0x46d5ab
cmp byte [esp + 0x39], 0x3a
je 0x46d5e4
movzx eax, byte [esp + 0x13]
lea edx, [esp + 0x140]
push 0
push eax
lea ecx, [esp + 0x40]
call fcn.0046d490
add esp, 8
test al, al
je 0x46d6eb
mov dl, 1
lea ecx, [esp + 0x38]
call fcn.0046d700
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x238
ret
mov bl, byte [esp + 0x250]
lea eax, [esp + 0x140]
push eax
call edi
cmp eax, 0xffffffff
je 0x46d614
test al, 0x10
je 0x46d6eb
mov al, byte [esp + 0x13]
test al, al
je 0x46d6eb
test bl, bl
jne 0x46d64c
jmp 0x46d62e
test bl, bl
jne 0x46d64c
xor edx, edx
lea ecx, [esp + 0x140]
call fcn.00453b10
test al, al
je 0x46d6eb
lea ecx, [esp + 0x38]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x46d633
mov eax, dword [0x4c03f8]
mov dword [ecx], eax
mov al, byte [0x4c03fc]
mov byte [ecx + 4], al
lea ecx, [esp + 0x38]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d653
sub ecx, edx
mov byte [esp + ecx + 0x39], al
lea ecx, [esp + 0x140]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d670
sub ecx, edx
mov dword [esp + 0x18], 0
xorps xmm0, xmm0
mov dword [esp + 0x32], 0
movlpd qword [esp + 0x2a], xmm0
mov byte [esp + ecx + 0x141], al
lea eax, [esp + 0x38]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x140]
mov dword [esp + 0x24], eax
movzx eax, bl
xor eax, 1
inc eax
mov dword [esp + 0x1c], eax
mov eax, 0x614
mov word [esp + 0x28], ax
cmp ebp, 2
jne 0x46d6d0
mov eax, 0x615
mov word [esp + 0x28], ax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
pop edi
pop esi
test eax, eax
pop ebp
sete al
pop ebx
add esp, 0x238
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x238
ret