Function at 0x412430
Capabilities:
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x44142f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x228
mov eax, dword [0x4551e4]
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov edi, dword [esp + 0x248]
mov dword [ebx + 0x44], edi
mov ecx, dword [edi + 0x58]
test ecx, ecx
mov dword [esp + 0x234], eax
mov dword [esp + 0x1c], ebx
jne 0x412479
mov eax, dword [edi + 0x54]
test eax, eax
je 0x4124ab
mov eax, dword [0x45616c]
mov eax, dword [eax + 0x14]
cmp edi, dword [eax + 0x68]
jne 0x41249f
test ecx, ecx
jne 0x41249f
mov ecx, dword [ebx + 0x28]
test ecx, ecx
je 0x4124ab
mov ecx, dword [edi + 0x34]
test ecx, ecx
jne 0x41249f
mov ecx, dword [edi + 0x38]
test ecx, ecx
je 0x4124ab
add eax, 0x20
lea ecx, [edi + 0x48]
push eax
call fcn.00402f50
mov eax, dword [0x45616c]
mov ecx, dword [eax + 0x14]
cmp edi, dword [ecx + 0x6c]
jne 0x412880
mov edx, ecx
lea esi, [edi + 0x18]
push esi
add edx, 0x14
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.00407fd0
push 0x443cf8
push eax
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24c], 0
call fcn.00403020
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x240], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412511
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.UserActionInfo.dll
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00403020
mov eax, dword [eax]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call ebp
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41254e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.UserInfo.dll
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00403020
mov eax, dword [eax]
push eax
call ebp
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412585
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.UsrDatTranClt.dll
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00403020
mov eax, dword [eax]
push eax
call ebp
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4125bc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.WnOnlineService.exe
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00403020
mov eax, dword [eax]
push eax
call ebp
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4125f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push 0x446adc
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00403020
mov eax, dword [eax]
push eax
call ebp
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41262a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
lea eax, [edi + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.00407fd0
push 0x443cf8
push eax
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x24c], 3
call fcn.00403020
mov eax, dword [esp + 0x28]
mov bl, 5
add eax, 0xfffffff0
mov byte [esp + 0x240], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412678
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.dll32UserActionInfo.dll
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00403020
mov eax, dword [eax]
push eax
call ebp
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4126af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.dll32UserInfo.dll
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00403020
mov eax, dword [eax]
push eax
call ebp
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4126e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.dll64UserActionInfo.dll
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00403020
mov eax, dword [eax]
push eax
call ebp
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41271d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.dll64UserInfo.dll
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00403020
mov eax, dword [eax]
push eax
call ebp
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412754
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [edi + 0x54]
test eax, eax
mov eax, dword [0x45616c]
mov ecx, dword [eax + 0x14]
lea edx, [esp + 0x10]
push esi
je 0x4127b3
add ecx, 0x1c
push ecx
push edx
call fcn.00407fd0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str._skin_
push eax
push ecx
mov byte [esp + 0x250], 6
call fcn.00403020
mov ecx, dword [esp + 0x20]
call fcn.0040f8a0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x240], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x412801
add ecx, 0x1c
push ecx
push edx
call fcn.00407fd0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str._skin_
push eax
push ecx
mov byte [esp + 0x250], 7
call fcn.00403020
mov edx, dword [0x45616c]
mov ecx, dword [edx + 0x28]
call fcn.00408080
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x240], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41280b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x240], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412831
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x240], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41285a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ebx, dword [esp + 0x1c]
mov ecx, ebx
call fcn.00410a40
mov ecx, ebx
call fcn.00411050
push edi
mov ecx, ebx
call fcn.00411830
test eax, eax
mov dword [edi + 0x30], eax
jne 0x412888
jmp 0x412d01
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x41285e
mov esi, dword [edi + 0x60]
cmp esi, dword [edi + 0x64]
je 0x412a18
lea ebx, [edi + 0x18]
push ebx
add edi, 0x48
push edi
lea eax, [esp + 0x30]
push eax
call fcn.00407fd0
push 0x443cf8
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x24c], 8
call fcn.00403020
push esi
push eax
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x24c], 9
call fcn.00407fd0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x240], 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4128fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0x240], 0xb
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412921
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push ebx
push edi
lea eax, [esp + 0x1c]
push eax
call fcn.00407fd0
push 0x443cf8
push eax
lea ecx, [esp + 0x2c]
push ecx
mov byte [esp + 0x24c], 0xd
call fcn.00403020
lea edx, [esi + 4]
push edx
push eax
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x24c], 0xe
call fcn.00407fd0
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x240], 0xd
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412982
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x240], 0xb
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4129a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4129d2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x10]
mov dword [esp + 0x240], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4129f7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x248]
mov ecx, dword [eax + 0x64]
add esi, 8
cmp esi, ecx
mov edi, eax
jne 0x412897
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, dword [esp + 0x1c]
mov ecx, dword [0x45616c]
mov edx, dword [ecx + 0x14]
cmp edi, dword [edx + 0x68]
jne 0x412bc0
lea eax, [edi + 0x18]
push eax
lea ecx, [edi + 0x48]
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.00407fd0
push 0x443cf8
push eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24c], 0xf
call fcn.00403020
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x240], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412a7d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.UserActionInfo.dll
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00403020
mov eax, dword [eax]
push eax
call ebp
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412ab4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.UserInfo.dll
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00403020
mov eax, dword [eax]
push eax
call ebp
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412aeb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.UsrDatTranClt.dll
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00403020
mov eax, dword [eax]
push eax
call ebp
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412b22
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.WnOnlineService.exe
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00403020
mov eax, dword [eax]
push eax
call ebp
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412b59
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push 0x446adc
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00403020
mov eax, dword [eax]
push eax
call ebp
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412b90
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, ebx
call fcn.00410090
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x240], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412bc0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [edi + 0x10]
push 0x443d70
push eax
call fcn.00423d1d
add esp, 8
test eax, eax
jne 0x412bf5
mov eax, dword [edi + 8]
push eax
lea ecx, [esp + 0x30]
push 0x446c98
push ecx
call fcn.0042396a
add esp, 0xc
lea edx, [esp + 0x2c]
push edx
jmp 0x412cf1
mov eax, dword [edi + 0x54]
test eax, eax
mov eax, dword [edi + 0x34]
je 0x412c2e
test eax, eax
jne 0x412c0e
mov eax, dword [edi + 0x38]
test eax, eax
je 0x412cfc
mov dword [ebx + 0x3c], 1
mov eax, dword [0x45616c]
mov ecx, dword [eax + 0x20]
push edi
call fcn.004099c0
mov ecx, dword [edi + 8]
push ecx
push 0x446c68
jmp 0x412c42
test eax, eax
jne 0x412c59
mov eax, dword [edi + 0x38]
test eax, eax
jne 0x412c59
mov ecx, dword [edi + 8]
push ecx
push 0x446c54
lea edx, [esp + 0x34]
push edx
call fcn.0042396a
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
jmp 0x412cf1
mov ecx, dword [0x45616c]
mov ecx, dword [ecx + 0x20]
push edi
call fcn.004093d0
mov edx, dword [edi + 8]
test eax, eax
lea eax, [esp + 0x2c]
je 0x412cd9
push edx
push 0x446c3c
push eax
call fcn.0042396a
add esp, 0xc
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [0x45616c]
call fcn.00408490
mov eax, dword [0x45616c]
mov edx, dword [eax + 0x14]
cmp edi, dword [edx + 0x6c]
jne 0x412cfc
mov ecx, dword [ebx + 0x2c]
test ecx, ecx
je 0x412cfc
mov ecx, dword [eax + 0x20]
call fcn.004097f0
mov eax, dword [0x45616c]
mov ecx, dword [eax + 0x14]
push str.wnwb32wnwb.ime
add ecx, 0x1c
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.00403020
mov eax, dword [eax]
push eax
call ebp
lea ecx, [esp + 0x1c]
call fcn.00401060
jmp 0x412cfc
mov ecx, dword [edi + 8]
push ecx
push edx
push 0x446be8
push eax
call fcn.0042396a
add esp, 0x10
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [0x45616c]
call fcn.00408490
mov eax, 1
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x234]
call fcn.00423492
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x234
ret 4