Function at 0x4326f5
Capabilities:
Copy file
Create process on windows
Move file

Disassembly:
push 0xa0
mov eax, 0x47b4f7
call fcn.0045053c
mov dword [ebp - 0x3c], edx
mov esi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x24], ebx
call fcn.00409480
push eax
lea ecx, [ebp - 0x34]
call fcn.00408c39
mov dword [ebp - 4], 1
call fcn.00409480
push eax
lea ecx, [ebp - 0x48]
call fcn.00408c39
mov byte [ebp - 4], 3
call fcn.00409480
push eax
lea ecx, [ebp - 0x28]
call fcn.00408c39
mov byte [ebp - 4], 5
lea eax, [ebp - 0x24]
push eax
push str.ApplyDirUpdate
lea ecx, [ebp - 0x68]
mov byte [ebp - 0x35], bl
mov byte [ebp - 0x19], bl
call fcn.0041dfa0
mov byte [ebp - 4], 6
test esi, esi
jne 0x43277a
push 0x57
mov edi, dword [ebp - 0x28]
pop ebx
jmp 0x432ccd
mov ecx, esi
call fcn.0040b056
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.0040afd8
push 0x5c
pop esi
push esi
push 0x2f
lea ecx, [ebp - 0x34]
call fcn.0040a11e
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x34]
mov eax, dword [eax - 0xc]
dec eax
push eax
call fcn.0040a264
cmp ax, si
je 0x4327b7
push ecx
lea ecx, [ebp - 0x34]
call fcn.0040a199
push 0x48fcd4
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x44]
call fcn.0040a03a
pop ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x48]
push eax
call fcn.0040a1c3
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x44]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov esi, dword [ebp - 0x48]
mov ecx, esi
call fcn.0041f708
test al, al
jne 0x4327f9
push 0xd
jmp 0x432771
cmp dword [0x4a03c8], 4
je 0x432cb3
push 0x4a02f8
lea edx, [ebp - 0x34]
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x14], ebx
call fcn.0041aaa2
pop ecx
push 9
pop ecx
mov dword [ebp - 0x44], ecx
mov byte [ebp - 4], cl
lea ecx, [ebp - 0x28]
push eax
call fcn.0040a1c3
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x40]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov edi, dword [ebp - 0x28]
mov ecx, edi
call fcn.0041f708
test al, al
je 0x43287c
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.00421c85
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
jne 0x432cd0
mov edx, 0x4a03cc
lea ecx, [ebp - 0x18]
call fcn.0041e570
test eax, eax
jle 0x432cb6
mov al, 1
jmp 0x432882
mov ebx, dword [ebp - 0x24]
mov al, byte [ebp - 0x35]
test ebx, ebx
jne 0x432cd0
test al, al
je 0x432cb6
xor eax, eax
lea edi, [ebp - 0x5c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00409480
push eax
lea ecx, [ebp - 0x2c]
call fcn.00408c39
mov byte [ebp - 4], 0xc
call fcn.00409480
push eax
lea ecx, [ebp - 0x30]
call fcn.00408c39
mov byte [ebp - 4], 0xe
call fcn.00409480
push eax
lea ecx, [ebp - 0x14]
call fcn.00408c39
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0xac]
push 0x44
pop edi
push edi
push ebx
push eax
mov byte [ebp - 0x19], bl
call fcn.00451b90
push esi
push str._applyupdate
push str._emupdater
push dword [0x4a02f8]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0xac], edi
push str._s__s__s___s_
push eax
call fcn.00408e2a
mov esi, dword [ebp - 0x20]
add esp, 0x24
test esi, esi
je 0x43293b
mov edi, 0x48cf40
mov ecx, edi
call fcn.0040b056
push eax
push edi
lea ecx, [ebp - 0x2c]
call fcn.0040c3a0
mov ecx, esi
call fcn.0040b056
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.0040c3a0
mov esi, dword [ebp - 0x3c]
test esi, esi
je 0x432984
call fcn.00409480
push eax
lea ecx, [ebp - 0x20]
call fcn.00408c39
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x20]
push esi
push str.__autoversion__u
push eax
call fcn.00408e2a
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x2c]
add esp, 0xc
push dword [esi - 0xc]
push esi
call fcn.0040c3a0
mov byte [ebp - 4], 0x10
lea ecx, [esi - 0x10]
call fcn.00409575
mov esi, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x28]
push edi
push esi
push str.Going_to_apply_update_using_attached_updater_id:_u_from_file__s
call fcn.0041dafb
push 0x4a02f8
mov edx, 0x4a03e4
lea ecx, [ebp - 0x20]
call fcn.0041aaa2
add esp, 0x10
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x30]
push eax
call fcn.0040a1c3
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00409575
push ecx
mov edx, 0x48c020
lea ecx, [ebp - 0x3c]
call fcn.0041e675
mov byte [ebp - 4], 0x16
lea edx, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x20]
call fcn.0041aaa2
pop ecx
pop ecx
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x14]
push eax
call fcn.0040a1c3
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00409575
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x20], 9
push ebx
push esi
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x432a57
cmp eax, 0x20
je 0x432a3e
cmp eax, 5
jne 0x432b2c
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x20], 1
push 0
pop ebx
jns 0x432a19
jmp 0x432b2c
mov byte [ebp - 0x19], 1
mov dword [ebp - 0x20], 9
push 1
push dword [ebp - 0x30]
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x432b1d
cmp eax, 0x20
je 0x432a88
cmp eax, 5
jne 0x432a99
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x20], 1
jns 0x432a62
mov dword [ebp - 0x20], 9
push 0
push dword [ebp - 0x30]
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x432b16
cmp eax, 0x20
je 0x432ac2
cmp eax, 5
jne 0x432ad3
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x20], 1
jns 0x432aa0
mov edi, dword [ebp - 0x30]
push 9
pop ebx
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x20], 0
jne 0x432b10
cmp eax, 0x20
je 0x432afc
cmp eax, 5
jne 0x432b0c
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jns 0x432ad9
cmp dword [ebp - 0x20], 0
sete byte [ebp - 0x19]
jmp 0x432b29
xor ebx, ebx
mov byte [ebp - 0x19], bl
jmp 0x432b2e
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040a1c3
mov edi, dword [ebp - 0x28]
xor ebx, ebx
mov esi, dword [ebp - 0x2c]
cmp dword [esi - 4], 1
jle 0x432b45
push dword [esi - 0xc]
lea ecx, [ebp - 0x2c]
call fcn.0040907c
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0xac]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x432b6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
push ecx
lea ecx, [ebp - 0x2c]
call fcn.004089f1
cmp dword [ebp - 0x24], 0
je 0x432b8e
push dword [ebp - 0x24]
push esi
push edi
push str.Unable_to_execute__s__s_gle_u
call fcn.0041dafb
mov eax, dword [ebp - 0x24]
jmp 0x432bbb
push 0xffffffffffffffff
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x40]
push esi
push edi
push str._s__s_exitcode_u
call fcn.0041dafb
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
add esp, 0x10
test eax, eax
je 0x432c05
cmp byte [ebp - 0x19], 0
je 0x432c05
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x30]
push 1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x432bff
cmp eax, 0x20
je 0x432bee
cmp eax, 5
jne 0x432bff
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x44], 1
jns 0x432bce
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
call fcn.00420fdb
cmp dword [ebp - 0x24], 0
jne 0x432c68
call fcn.00433270
call fcn.00420b0e
call fcn.00420ab9
mov ebx, dword [0x4a03b8]
mov ecx, 0x4a03b8
push dword [ebx + 4]
push ecx
call fcn.0040c7a2
mov dword [ebx + 4], ebx
mov ecx, 0x4a03c0
mov dword [ebx], ebx
mov dword [ebx + 8], ebx
mov ebx, dword [0x4a03c0]
and dword [0x4a03bc], 0
push dword [ebx + 4]
push ecx
call fcn.0040c83a
mov dword [ebx + 4], ebx
mov dword [ebx], ebx
mov dword [ebx + 8], ebx
and dword [0x4a03c4], 0
cmp dword [ebp - 0x58], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x432c79
push dword [ebp - 0x58]
call ebx
cmp dword [ebp - 0x5c], 0
je 0x432c84
push dword [ebp - 0x5c]
call ebx
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 6
lea ecx, [esi - 0x10]
call fcn.00409575
mov ebx, dword [ebp - 0x24]
jmp 0x432cd0
mov edi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp - 0x19]
push eax
mov edx, esi
call fcn.004296e9
mov ebx, eax
mov al, byte [ebp - 0x19]
pop ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x24], ebx
mov esi, dword [ebp - 0x34]
cmp dword [esi - 0xc], 0
je 0x432ce9
cmp byte [ebp - 0x4c], 0
jne 0x432ce9
mov ecx, esi
call fcn.0041e914
mov ebx, dword [ebp - 0x24]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x68]
call fcn.0041e015
mov byte [ebp - 4], 3
lea ecx, [edi - 0x10]
call fcn.00409575
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.00409575
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00409575
mov eax, ebx
call fcn.004504e6
ret