Function at 0x4471a0
Capabilities:
Access peb ldr_data
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x5f3eb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [0x60c46c]
push ebx
push esi
push edi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x30], 0
test eax, eax
mov eax, dword [0x687630]
je 0x44735b
test eax, eax
je 0x4471fa
push str.CUpAgentFileMgr::UpdateModule________Upgrage_
push str.Update
push 0xf
push 0x6875c4
call fcn.00431af0
add esp, 0x10
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, 0x6659c4
mov bl, 1
mov edx, dword [esi - 4]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.005e0fa7
mov eax, dword [esi]
lea ecx, [esp + 0x3c]
push eax
push ecx
call fcn.004440a0
add esp, 0xc
mov eax, dword [eax]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x34], bl
call fcn.00467600
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 0
call fcn.005e0ee7
mov edx, dword [esp + 0xc]
push 0
push edx
call fcn.0048fcc0
add esp, 8
test eax, eax
je 0x44728a
mov eax, dword [esp + 0xc]
push 4
push 0
push eax
call edi
mov eax, dword [0x687630]
test eax, eax
je 0x44728a
mov ecx, dword [esp + 0xc]
push ecx
push str.CUpAgentFileMgr::UpdateModule_X86__s_
push str.Update
push 0xf
push 0x6875c4
call fcn.00431af0
add esp, 0x14
add esi, 8
cmp esi, 0x665a6c
jb 0x447207
call fcn.00484360
test eax, eax
je 0x4474d8
lea ecx, [esp + 0x14]
call fcn.0040a2e0
mov byte [esp + 0x30], 2
mov esi, 0x665a6c
mov bl, 3
mov edx, dword [esi - 4]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.005e0fa7
mov eax, dword [esi]
lea ecx, [esp + 0x3c]
push eax
push ecx
call fcn.004440a0
add esp, 0xc
mov eax, dword [eax]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x34], bl
call fcn.00467600
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 2
call fcn.005e0ee7
mov edx, dword [esp + 0xc]
push 0
push edx
call fcn.0048fcc0
add esp, 8
test eax, eax
je 0x44733e
mov eax, dword [esp + 0xc]
push 4
push 0
push eax
call edi
mov eax, dword [0x687630]
test eax, eax
je 0x44733e
mov ecx, dword [esp + 0xc]
push ecx
push str.CUpAgentFileMgr::UpdateModule_X64__s_
push str.Update
push 0xf
push 0x6875c4
call fcn.00431af0
add esp, 0x14
add esi, 8
cmp esi, 0x665b04
jb 0x4472bb
mov byte [esp + 0x30], 0
lea ecx, [esp + 0x14]
jmp 0x4474d3
test eax, eax
je 0x447378
push str.CUpAgentFileMgr::UpdateModule________Degrage_
push str.Update
push 0xf
push 0x6875c4
call fcn.00431af0
add esp, 0x10
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, 0x665b04
mov edx, dword [esi - 4]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.005e0fa7
mov eax, dword [esi]
lea ecx, [esp + 0x3c]
push eax
push ecx
call fcn.004440a0
add esp, 0xc
mov eax, dword [eax]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x34], 4
call fcn.00467600
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 0
call fcn.005e0ee7
mov edx, dword [esp + 0xc]
push 0
push edx
call fcn.0048fcc0
add esp, 8
test eax, eax
je 0x447407
mov eax, dword [esp + 0xc]
push 4
push 0
push eax
call edi
mov eax, dword [0x687630]
test eax, eax
je 0x447407
mov ecx, dword [esp + 0xc]
push ecx
push str.CUpAgentFileMgr::UpdateModule_X86__s_
push str.Update
push 0xf
push 0x6875c4
call fcn.00431af0
add esp, 0x14
add esi, 8
cmp esi, 0x665b34
jb 0x447383
call fcn.00484360
test eax, eax
je 0x4474d8
lea ecx, [esp + 0x14]
call fcn.0040a2e0
mov byte [esp + 0x30], 5
mov esi, 0x665b34
mov bl, 6
mov edx, dword [esi - 4]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.005e0fa7
mov eax, dword [esi]
lea ecx, [esp + 0x3c]
push eax
push ecx
call fcn.004440a0
add esp, 0xc
mov eax, dword [eax]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x34], bl
call fcn.00467600
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 5
call fcn.005e0ee7
mov edx, dword [esp + 0xc]
push 0
push edx
call fcn.0048fcc0
add esp, 8
test eax, eax
je 0x4474bb
mov eax, dword [esp + 0xc]
push 4
push 0
push eax
call edi
mov eax, dword [0x687630]
test eax, eax
je 0x4474bb
mov ecx, dword [esp + 0xc]
push ecx
push str.CUpAgentFileMgr::UpdateModule_X64__s_
push str.Update
push 0xf
push 0x6875c4
call fcn.00431af0
add esp, 0x14
add esi, 8
cmp esi, 0x665b64
jb 0x447438
mov byte [esp + 0x30], 0
lea ecx, [esp + 0x14]
call fcn.0040a330
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00467250
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret