Function at 0x447150
Capabilities:
Access peb ldr_data
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x5f2198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [0x60a46c]
push ebx
push esi
push edi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x30], 0
test eax, eax
mov eax, dword [0x6844b0]
je 0x44730b
test eax, eax
je 0x4471aa
push str.CUpAgentFileMgr::UpdateModule________Upgrage_
push str.Update
push 0xf
push 0x684444
call fcn.00431aa0
add esp, 0x10
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, 0x662924
mov bl, 1
mov edx, dword [esi - 4]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.005df287
mov eax, dword [esi]
lea ecx, [esp + 0x3c]
push eax
push ecx
call fcn.00444050
add esp, 0xc
mov eax, dword [eax]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x34], bl
call fcn.004675b0
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 0
call fcn.005df1c7
mov edx, dword [esp + 0xc]
push 0
push edx
call fcn.0048fc70
add esp, 8
test eax, eax
je 0x44723a
mov eax, dword [esp + 0xc]
push 4
push 0
push eax
call edi
mov eax, dword [0x6844b0]
test eax, eax
je 0x44723a
mov ecx, dword [esp + 0xc]
push ecx
push str.CUpAgentFileMgr::UpdateModule_X86__s_
push str.Update
push 0xf
push 0x684444
call fcn.00431aa0
add esp, 0x14
add esi, 8
cmp esi, 0x6629cc
jb 0x4471b7
call fcn.00484310
test eax, eax
je 0x447488
lea ecx, [esp + 0x14]
call fcn.0040a2e0
mov byte [esp + 0x30], 2
mov esi, 0x6629cc
mov bl, 3
mov edx, dword [esi - 4]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.005df287
mov eax, dword [esi]
lea ecx, [esp + 0x3c]
push eax
push ecx
call fcn.00444050
add esp, 0xc
mov eax, dword [eax]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x34], bl
call fcn.004675b0
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 2
call fcn.005df1c7
mov edx, dword [esp + 0xc]
push 0
push edx
call fcn.0048fc70
add esp, 8
test eax, eax
je 0x4472ee
mov eax, dword [esp + 0xc]
push 4
push 0
push eax
call edi
mov eax, dword [0x6844b0]
test eax, eax
je 0x4472ee
mov ecx, dword [esp + 0xc]
push ecx
push str.CUpAgentFileMgr::UpdateModule_X64__s_
push str.Update
push 0xf
push 0x684444
call fcn.00431aa0
add esp, 0x14
add esi, 8
cmp esi, 0x662a64
jb 0x44726b
mov byte [esp + 0x30], 0
lea ecx, [esp + 0x14]
jmp 0x447483
test eax, eax
je 0x447328
push str.CUpAgentFileMgr::UpdateModule________Degrage_
push str.Update
push 0xf
push 0x684444
call fcn.00431aa0
add esp, 0x10
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, 0x662a64
mov edx, dword [esi - 4]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.005df287
mov eax, dword [esi]
lea ecx, [esp + 0x3c]
push eax
push ecx
call fcn.00444050
add esp, 0xc
mov eax, dword [eax]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x34], 4
call fcn.004675b0
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 0
call fcn.005df1c7
mov edx, dword [esp + 0xc]
push 0
push edx
call fcn.0048fc70
add esp, 8
test eax, eax
je 0x4473b7
mov eax, dword [esp + 0xc]
push 4
push 0
push eax
call edi
mov eax, dword [0x6844b0]
test eax, eax
je 0x4473b7
mov ecx, dword [esp + 0xc]
push ecx
push str.CUpAgentFileMgr::UpdateModule_X86__s_
push str.Update
push 0xf
push 0x684444
call fcn.00431aa0
add esp, 0x14
add esi, 8
cmp esi, 0x662a94
jb 0x447333
call fcn.00484310
test eax, eax
je 0x447488
lea ecx, [esp + 0x14]
call fcn.0040a2e0
mov byte [esp + 0x30], 5
mov esi, 0x662a94
mov bl, 6
mov edx, dword [esi - 4]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.005df287
mov eax, dword [esi]
lea ecx, [esp + 0x3c]
push eax
push ecx
call fcn.00444050
add esp, 0xc
mov eax, dword [eax]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x34], bl
call fcn.004675b0
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 5
call fcn.005df1c7
mov edx, dword [esp + 0xc]
push 0
push edx
call fcn.0048fc70
add esp, 8
test eax, eax
je 0x44746b
mov eax, dword [esp + 0xc]
push 4
push 0
push eax
call edi
mov eax, dword [0x6844b0]
test eax, eax
je 0x44746b
mov ecx, dword [esp + 0xc]
push ecx
push str.CUpAgentFileMgr::UpdateModule_X64__s_
push str.Update
push 0xf
push 0x684444
call fcn.00431aa0
add esp, 0x14
add esi, 8
cmp esi, 0x662ac4
jb 0x4473e8
mov byte [esp + 0x30], 0
lea ecx, [esp + 0x14]
call fcn.0040a330
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00467200
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret