Function at 0x46e7c0
Capabilities:
Copy file
Delete file
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2a74
call fcn.004e1f60
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push 0x572530
mov dword [ebp - 0x2a6c], ebx
mov dword [ebp - 0x2a70], esi
call fcn.0046d190
add esp, 4
test eax, eax
jne 0x46e80c
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
push edi
push 0x571d28
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
xor edi, edi
nop word [eax + eax]
push 0x802
lea eax, [ebp - 0x1810]
push 0
push eax
call fcn.004e46b0
push 0x519c28
push dword [edi + 0x55ba9c]
call fcn.0042c560
add esp, 0x14
test eax, eax
je 0x46e857
cmp dword [0x57150c], 0
jne 0x46ec02
lea eax, [ebp - 0x2014]
push eax
mov eax, dword [edi + 0x55ba9c]
push esi
movzx eax, word [eax]
push eax
call fcn.00471490
add esp, 0xc
test eax, eax
je 0x46ec02
mov eax, dword [edi + 0x55ba9c]
add eax, 2
push eax
lea eax, [ebp - 0x2014]
push eax
lea eax, [ebp - 0x808]
push str._s_s
push eax
call fcn.004054c0
lea eax, [ebp - 0x808]
push eax
push str.INSTALLING
push ebx
call fcn.004721e0
push 0x519c28
push dword [edi + 0x55ba9c]
call fcn.0042c560
add esp, 0x24
test eax, eax
je 0x46e93c
lea eax, [ebp - 0x808]
push eax
push 0x572530
call fcn.00414dc0
mov esi, eax
add esp, 8
test esi, esi
je 0x46eb0b
lea eax, [ebp - 0x100c]
push 0x519c28
push eax
call fcn.0041ee50
lea eax, [ebp - 0x100c]
push eax
call fcn.00414f30
add esp, 0xc
test eax, eax
je 0x46eb03
lea eax, [ebp - 0x100c]
push eax
push str.INSTALLING
push ebx
call fcn.004721e0
add esp, 0xc
lea eax, [ebp - 0x100c]
push 0
push eax
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
mov esi, eax
jmp 0x46eb03
xor ebx, ebx
call fcn.0041bf70
test eax, eax
je 0x46e979
push str.DCnCrypt.sys
push dword [edi + 0x55ba9c]
call fcn.004e85f7
add esp, 8
test eax, eax
jne 0x46e979
push 0x10
lea ebx, [eax + 1]
lea eax, [ebp - 0x1810]
push str.CnCrypt_x64.sys
push eax
call fcn.004ec074
add esp, 0xc
jmp 0x46e9a0
mov ecx, dword [edi + 0x55ba9c]
lea edx, [ebp - 0x1810]
add ecx, 2
sub edx, ecx
nop word [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x46e990
lea eax, [ebp - 0x1810]
push eax
call fcn.00471280
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
jne 0x46e9c3
push 2
call dword [sym.imp.KERNEL32.DLL_SetLastError]
jmp 0x46eb0b
test ebx, ebx
jne 0x46ea2f
lea eax, [ebp - 0x808]
push str.CnCrypt_Shell
push eax
call fcn.0042c560
add esp, 8
test eax, eax
jne 0x46e9f7
lea eax, [ebp - 0x808]
push str.CnCrypt.sys
push eax
call fcn.0042c560
add esp, 8
test eax, eax
je 0x46ea06
lea eax, [ebp - 0x808]
push eax
call fcn.0046d750
add esp, 4
lea eax, [esi + esi*4]
push 0
push dword [eax*4 + 0x570c90]
push dword [eax*4 + 0x570c94]
lea eax, [ebp - 0x808]
push eax
call fcn.004155e0
add esp, 0x10
mov esi, eax
jmp 0x46eafd
push 0
call fcn.00415db0
add esp, 4
test eax, eax
je 0x46eb0b
lea eax, [ebp - 0x808]
push str.CnCrypt_Shell
push eax
call fcn.0042c560
add esp, 8
test eax, eax
jne 0x46ea71
lea eax, [ebp - 0x808]
push str.CnCrypt.sys
push eax
call fcn.0042c560
add esp, 8
test eax, eax
je 0x46ea80
lea eax, [ebp - 0x808]
push eax
call fcn.0046d750
add esp, 4
lea eax, [esi + esi*4]
push 0
push dword [eax*4 + 0x570c90]
push dword [eax*4 + 0x570c94]
lea eax, [ebp - 0x808]
push eax
call fcn.004155e0
push 1
mov esi, eax
call fcn.00415db0
add esp, 0x14
test eax, eax
je 0x46eb0b
test esi, esi
je 0x46eb0b
cmp dword [0x5714fc], 0
je 0x46eafd
cmp dword [0x571504], 0
je 0x46eafd
cmp dword [0x5714dc], 0x700
jge 0x46eafd
push 1
push str.System32driversCnCrypt.sys
push str.ImagePath
push str.SYSTEMCurrentControlSetServicesCnCrypt
call fcn.004c1090
mov esi, eax
add esp, 0x10
test esi, esi
je 0x46eb0b
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov ebx, dword [ebp - 0x2a6c]
test esi, esi
jne 0x46ebfc
cmp dword [0x568600], 0
jne 0x46ebf6
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push 0
mov esi, eax
lea eax, [ebp - 0x2a74]
push eax
push 0x400
push esi
push 0
push 0x1100
call dword [sym.imp.KERNEL32.DLL_FormatMessageW]
test eax, eax
je 0x46eb7a
push dword [ebp - 0x2a74]
lea eax, [ebp - 0x808]
push eax
push str.INSTALL_OF_FAILED
call fcn.004bb8b0
add esp, 4
push eax
lea eax, [ebp - 0xd84]
push eax
call fcn.004054c0
add esp, 0x10
push dword [ebp - 0x2a74]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
jmp 0x46ebc3
push esi
push str.ERR_SYSTEM_UNKNOWN
call fcn.004bb8b0
add esp, 4
push eax
lea eax, [ebp - 0x2818]
push eax
call fcn.004054c0
add esp, 0xc
lea eax, [ebp - 0x2818]
push eax
lea eax, [ebp - 0x808]
push eax
push str.INSTALL_OF_FAILED
call fcn.004bb8b0
add esp, 4
push eax
lea eax, [ebp - 0xd84]
push eax
call fcn.004054c0
add esp, 0x10
mov ebx, dword [ebp - 0x2a6c]
lea eax, [ebp - 0xd84]
push ebx
push eax
call fcn.004194a0
add esp, 8
cmp eax, 6
je 0x46ebfc
call fcn.0046c810
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x2a6c]
mov esi, dword [ebp - 0x2a70]
add edi, 4
cmp edi, 0x10
jb 0x46e820
call fcn.0046c810
mov edi, dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
push 0x571d28
call edi
lea eax, [ebp - 0x2a68]
push eax
push str.Language..xml
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x46ec86
lea eax, [ebp - 0x2a3c]
push eax
push dword [ebp - 0x2a70]
lea eax, [ebp - 0x1810]
push str._s_s
push eax
call fcn.004054c0
lea eax, [ebp - 0x1810]
push eax
push str.INSTALLING
push ebx
call fcn.004721e0
lea eax, [ebp - 0x1810]
push eax
lea eax, [ebp - 0x2a3c]
push eax
call fcn.00414dc0
add esp, 0x24
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
push 0x571d28
call edi
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e1f40
mov esp, ebp
pop ebp
ret