Function at 0x4332e0
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x48546b
mov eax, dword fs:[0]
push eax
sub esp, 0x97c
mov eax, dword [0x4b59f4]
xor eax, esp
mov dword [esp + 0x978], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b59f4]
xor eax, esp
push eax
lea eax, [esp + 0x990]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x554]
mov ebp, 0x10
sub eax, ebp
push eax
call fcn.00432780
lea esi, [eax + 0x10]
add esp, 4
mov dword [esp + 0x14], esi
mov ecx, dword [esi - 8]
mov eax, 1
sub eax, dword [esi - 4]
xor ebx, ebx
or ecx, eax
mov dword [esp + 0x998], ebx
jge 0x433360
push ebx
lea ecx, [esp + 0x18]
call fcn.00430410
mov esi, dword [esp + 0x14]
push esi
lea eax, [esp + 0x8c]
push str._sReplacer.exe
push eax
call fcn.0047052a
add esp, 0xc
lea ecx, [esp + 0x88]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4333f2
push str.UILM_MSG_NOTEXITS_REPLACERFILE
mov ecx, 0x4b8fb0
call fcn.00448f40
cmp dword [eax + 0x18], ebp
jb 0x4333a2
mov eax, dword [eax + 4]
jmp 0x4333a5
add eax, 4
push eax
lea edx, [esp + 0x1c]
push edx
mov ecx, 0x4b8fb0
call fcn.00447f00
cmp dword [eax + 0x18], ebp
jb 0x4333bf
mov eax, dword [eax + 4]
jmp 0x4333c2
add eax, 4
push ebp
push str.Black_Pearl
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0x30]
cmp eax, ebp
jb 0x433515
add eax, 1
push eax
mov eax, dword [esp + 0x20]
push eax
call fcn.00406020
add esp, 8
jmp 0x433515
mov ecx, dword [esi - 8]
mov eax, 1
sub eax, dword [esi - 4]
or ecx, eax
jge 0x43340f
push ebx
lea ecx, [esp + 0x18]
call fcn.00430410
mov esi, dword [esp + 0x14]
mov ecx, dword [edi + 0x550]
push esi
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push str.Silkroad.exe
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x1a0]
push str._s__s__d__ld__s
push eax
call fcn.0047052a
push 0x40
lea ecx, [esp + 0x68]
push ebx
push ecx
call fcn.004704b0
add esp, 0x28
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x48]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x1ac]
push ecx
push ebx
mov dword [esp + 0x6c], 0x44
mov dword [esp + 0x98], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x433515
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.UILM_MSG_DETECTED_ABNORMAL_REPLACERFILE
mov ecx, 0x4b8fb0
mov edi, eax
call fcn.00448f40
cmp dword [eax + 0x18], ebp
jb 0x4334a5
mov eax, dword [eax + 4]
jmp 0x4334a8
add eax, 4
push eax
lea edx, [esp + 0x1c]
push edx
mov ecx, 0x4b8fb0
call fcn.00447f00
cmp dword [eax + 0x18], ebp
jb 0x4334c2
mov eax, dword [eax + 4]
jmp 0x4334c5
add eax, 4
push edi
push eax
lea eax, [esp + 0x594]
push eax
call fcn.0047052a
mov eax, dword [esp + 0x3c]
add esp, 0xc
cmp eax, ebp
jb 0x4334f0
mov ecx, dword [esp + 0x1c]
add eax, 1
push eax
push ecx
call fcn.00406020
add esp, 8
push ebp
push str.Black_Pearl
lea edx, [esp + 0x594]
push edx
push ebx
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esi - 0x10]
mov dword [esp + 0x998], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43353c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x990]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x978]
xor ecx, esp
call fcn.0046fe25
add esp, 0x988
ret