Function at 0x40a6b0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Delete file
Get common file path
Hide graphical window
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x6ac4
call fcn.005b89a0
push ebx
push esi
push edi
push 1
call fcn.005ab040
mov eax, dword [0x6f3558]
mov esi, dword [ebp + 0x10]
add esp, 4
cmp eax, 4
jne 0x40a7d2
xor eax, eax
mov ecx, 0x400
lea edi, [esp + 0xad0]
lea edx, [esp + 0xad0]
rep stosd dword es:[edi], eax
mov eax, esi
sub edx, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x40a700
xor eax, eax
mov ecx, 0x1400
lea edi, [esp + 0x1ad0]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xad0]
push 0x6a840c
push eax
call fcn.005b9860
add esp, 8
xor edi, edi
test eax, eax
je 0x40a76d
lea esi, [esp + 0x1ad0]
lea esp, [esp]
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x40a744
push 0x6a840c
push 0
call fcn.005b9860
add esp, 8
inc edi
add esi, 0x1000
test eax, eax
jne 0x40a740
cmp edi, 4
jge 0x40a774
push 0
call fcn.005b9820
xor eax, eax
jmp 0x40a780
mov cl, byte [esp + eax + 0x3ad0]
mov byte [eax + 0x703bd8], cl
inc eax
test cl, cl
jne 0x40a780
xor eax, eax
jmp 0x40a7a0
mov cl, byte [esp + eax + 0x4ad0]
mov byte [eax + 0x703bb4], cl
inc eax
test cl, cl
jne 0x40a7a0
xor eax, eax
jmp 0x40a7c0
mov cl, byte [esp + eax + 0x5ad0]
mov byte [eax + 0x7035e4], cl
inc eax
test cl, cl
jne 0x40a7c0
mov eax, dword [0x6f3558]
test eax, eax
jne 0x40a8a1
push 0
push 0x10
lea ecx, [esp + 0x8c8]
push ecx
push 0
call dword [sym.imp.shell32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x40a8a1
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x9c8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x8c0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a815
sub eax, edx
lea edx, [eax - 1]
test edx, edx
jl 0x40a833
mov al, 0x5c
cmp byte [esp + edx + 0x8c0], al
je 0x40a833
dec edx
jns 0x40a827
lea eax, [esp + 0x8c0]
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a840
sub eax, esi
mov ecx, eax
sub ecx, edx
lea esi, [esp + edx + 0x8c1]
mov edx, ecx
shr ecx, 2
lea edi, [esp + 0x9c8]
rep movsd dword es:[edi], dword [esi]
push 4
mov ecx, edx
lea eax, [esp + 0x9cc]
and ecx, 3
push 0x6a8404
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.005b9660
add esp, 0xc
test eax, eax
jne 0x40a8a1
push eax
push str.Error___
push str.Korea_Version
push eax
call dword [sym.imp.user32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [0x6f3558], 3
mov ebx, dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
mov esi, dword [sym.imp.kernel32.dll_DeleteFileA]
jne 0x40aa89
xor eax, eax
mov ecx, 0x200
lea edi, [esp + 0xad0]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xad0]
push ecx
push 0x800
call ebx
lea edx, [esp + 0xad0]
push edx
lea eax, [esp + 0xc4]
push str._sDataItemItem.SData
push eax
call fcn.005b8b8d
add esp, 0xc
lea ecx, [esp + 0xc0]
push ecx
call esi
lea edx, [esp + 0xad0]
push edx
lea eax, [esp + 0xc4]
push str._sDataNpcNpcQuest.SData
push eax
call fcn.005b8b8d
add esp, 0xc
lea ecx, [esp + 0xc0]
push ecx
call esi
lea edx, [esp + 0xad0]
push edx
lea eax, [esp + 0xc4]
push str._sServerSequenceItemCreate.ini
push eax
call fcn.005b8b8d
add esp, 0xc
lea ecx, [esp + 0xc0]
push ecx
call esi
lea edx, [esp + 0xad0]
push edx
lea eax, [esp + 0xc4]
push str._sServerItemDataExport_UNICODE.txt
push eax
call fcn.005b8b8d
add esp, 0xc
lea ecx, [esp + 0xc0]
push ecx
call esi
lea edx, [esp + 0xad0]
push edx
lea eax, [esp + 0xc4]
push str._sServerGuildHouse.ini
push eax
call fcn.005b8b8d
add esp, 0xc
lea ecx, [esp + 0xc0]
push ecx
call esi
lea edx, [esp + 0xad0]
push edx
lea eax, [esp + 0xc4]
push str._sServerVersion.txt
push eax
call fcn.005b8b8d
add esp, 0xc
lea ecx, [esp + 0xc0]
push ecx
call esi
lea edx, [esp + 0xad0]
push edx
lea eax, [esp + 0xc4]
push str._sServer.zip
push eax
call fcn.005b8b8d
add esp, 0xc
lea ecx, [esp + 0xc0]
push ecx
call esi
lea edx, [esp + 0xad0]
push edx
push str._sServer
lea eax, [esp + 0xc8]
push eax
call fcn.005b8b8d
lea ecx, [esp + 0xcc]
push ecx
call fcn.005b962a
lea edx, [esp + 0xae0]
push edx
lea eax, [esp + 0xd4]
push str._sDataItem
push eax
call fcn.005b8b8d
lea ecx, [esp + 0xdc]
push ecx
call fcn.005b962a
lea edx, [esp + 0xaf0]
push edx
lea eax, [esp + 0xe4]
push str._sDataNpc
push eax
call fcn.005b8b8d
lea ecx, [esp + 0xec]
push ecx
call fcn.005b962a
lea edx, [esp + 0xb00]
push edx
lea eax, [esp + 0xf4]
push str._sData
push eax
call fcn.005b8b8d
lea ecx, [esp + 0xfc]
push ecx
call fcn.005b962a
add esp, 0x40
call fcn.0040c7f0
push str.data_filter.txt
mov ecx, 0x7071a0
call fcn.0040a3f0
push 0x4c
call fcn.005b8072
add esp, 4
test eax, eax
je 0x40aab4
mov ecx, eax
call fcn.0041d240
jmp 0x40aab6
xor eax, eax
xor edx, edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
mov dword [0x7034d8], eax
cmp dword [0x2234f1c], 5
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], edx
jb 0x40aaed
mov eax, dword [str.Global_]
mov ecx, dword [0x6a82ec]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
lea edi, [esp + 0x18]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40aaf2
mov edx, dword [0x6a7ad0]
mov ax, word [0x6a7ad4]
mov cl, byte [0x6a7ad6]
mov dword [edi], edx
lea edx, [esp + 0x18]
push edx
push 0
mov word [edi + 4], ax
push 0
mov byte [edi + 6], cl
call dword [sym.imp.kernel32.dll_CreateMutexA]
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
jmp 0x40ab3f
mov edi, dword [sym.imp.user32.dll_FindWindowA]
push 0x6a7ad0
push 0x6a7ac4
call edi
test eax, eax
jmp 0x40ab85
mov esi, dword [ebp + 0x10]
push 0xb
push str.new_updater
push esi
call fcn.005b9660
add esp, 0xc
test eax, eax
jne 0x40ae7b
call fcn.0040ca30
xor esi, esi
push esi
push str.new_updater.exe
call fcn.005b95e4
mov ebx, dword [sym.imp.kernel32.dll_Sleep]
add esp, 8
cmp eax, 0xffffffff
jne 0x40abe5
inc esi
cmp esi, 0xa
jg 0x40ad7f
push 0x3e8
call ebx
push 0
push str.new_updater.exe
call fcn.005b95e4
add esp, 8
cmp eax, 0xffffffff
je 0x40abc0
push str.Shaiya_Updater
push str.32770
xor esi, esi
call edi
test eax, eax
je 0x40ac14
inc esi
cmp esi, 0xa
jg 0x40ac14
push 0x3e8
call ebx
push str.Shaiya_Updater
push str.32770
call edi
test eax, eax
jne 0x40abf7
push str.Shaiya_Updater
push str.32770
call edi
test eax, eax
je 0x40acc6
push str.Shaiya_Updater
push str.32770
call edi
test eax, eax
je 0x40ac8c
jmp 0x40ac40
push str.Shaiya_Updater
push str.32770
call edi
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x14]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.kernel32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.kernel32.dll_TerminateProcess]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
push str.Shaiya_Updater
push str.32770
call edi
test eax, eax
jne 0x40ac40
push 0x3e8
call ebx
push str.Shaiya_Updater
push str.32770
xor esi, esi
call edi
test eax, eax
je 0x40acc6
inc esi
cmp esi, 0xa
jg 0x40adbe
push 0x3e8
call ebx
push str.Shaiya_Updater
push str.32770
call edi
test eax, eax
jne 0x40aca5
mov esi, dword [sym.imp.kernel32.dll_DeleteFileA]
push str.Updater.exe
xor edi, edi
call esi
test eax, eax
jne 0x40acfc
lea esp, [esp]
inc edi
cmp edi, 0xa
jg 0x40adfd
push 0x3e8
call ebx
push str.Updater.exe
call esi
test eax, eax
je 0x40ace0
push str.Updater.exe
push str.new_updater.exe
xor esi, esi
call fcn.005b95b6
add esp, 8
test eax, eax
je 0x40ad3b
inc esi
cmp esi, 0xa
jg 0x40ae3c
push 0x3e8
call ebx
push str.Updater.exe
push str.new_updater.exe
call fcn.005b95b6
add esp, 8
test eax, eax
jne 0x40ad14
push 0x1f4
call ebx
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x40]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x44]
push edx
push eax
push eax
push eax
push 1
push eax
push eax
push 0x6a8290
push eax
mov dword [esp + 0x68], 0x44
call dword [sym.imp.kernel32.dll_CreateProcessA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x2748
call fcn.0041b230
push eax
lea eax, [esp + 0xc8]
push str._s_e01
push eax
call fcn.005b8b8d
add esp, 0x10
push 0
push 0
lea ecx, [esp + 0xc8]
push ecx
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x2748
call fcn.0041b230
push eax
lea ecx, [esp + 0xc8]
push str._s_e02
push ecx
call fcn.005b8b8d
add esp, 0x10
push 0
push 0
lea edx, [esp + 0xc8]
push edx
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x2748
call fcn.0041b230
push eax
lea eax, [esp + 0xc8]
push str._s_e03
push eax
call fcn.005b8b8d
add esp, 0x10
push 0
push 0
lea ecx, [esp + 0xc8]
push ecx
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x2748
call fcn.0041b230
push eax
lea edx, [esp + 0xc8]
push str._s_e04
push edx
call fcn.005b8b8d
add esp, 0x10
push 0
push 0
lea eax, [esp + 0xc8]
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0xa
push str.start_game
push esi
call fcn.005b9660
add esp, 0xc
test eax, eax
jmp 0x40af39
push str.ijl15.dll
call fcn.00408aa0
add esp, 4
cmp eax, 0x5b000
je 0x40afae
cmp dword [0x6f3558], 2
push 0
push 0x6a762c
jne 0x40af8d
call fcn.0053ad30
add esp, 4
push eax
push 0x2736
call fcn.0041b230
push eax
call fcn.0053ad30
add esp, 8
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x2736
call fcn.0041b230
add esp, 4
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.00407fd0
mov eax, dword [0x6f3558]
mov edi, 1
cmp eax, edi
jne 0x40afdc
push 0x703a70
lea eax, [esp + 0x44]
push eax
mov ecx, eax
push ecx
push str._s__s__s
push esi
call fcn.005b896b
add esp, 0x14
call fcn.00408960
test eax, eax
jne 0x40b04f
cmp dword [0x6f3558], 2
push 0x10
push str.ERROR___
jne 0x40b02a
call fcn.0053ad30
add esp, 4
push eax
push 0x2736
call fcn.0041b230
push eax
call fcn.0053ad30
mov edx, dword [0x703bfc]
add esp, 8
push eax
push edx
call dword [sym.imp.user32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x2736
call fcn.0041b230
add esp, 4
push eax
mov eax, dword [0x703bfc]
push eax
call dword [sym.imp.user32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.004089f0
cmp dword [0x6f3558], edi
jne 0x40b1af
xor eax, eax
mov ecx, pe_nt_image_headers32
lea edi, [esp + 0xc0]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc0]
push ecx
xor esi, esi
push 0x400
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call ebx
lea edx, [esp + 0xc]
push edx
push 0xf003f
push esi
push str.SOFTWARESONOVShaiya
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
cmp eax, esi
mov edi, dword [sym.imp.advapi32.dll_RegCloseKey]
je 0x40b12e
lea eax, [esp + 0x10]
push eax
push str.SOFTWARESONOVShaiya
push 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyA]
lea eax, [esp + 0xc0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b0d1
sub eax, edx
mov edx, dword [esp + 0x10]
push eax
lea ecx, [esp + 0xc4]
push ecx
push 1
push 0x6a8214
push edx
call dword [sym.imp.advapi32.dll_RegSetValueA]
lea eax, [esp + 0xc0]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b100
mov ecx, dword [esp + 0x10]
sub eax, edx
push eax
lea eax, [esp + 0xc4]
push eax
push 1
push esi
push 0x6a8214
push ecx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call edi
jmp 0x40b1a4
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc4]
push ecx
lea edx, [esp + 0x1c]
push edx
push esi
push 0x6a8214
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
lea eax, [esp + 0xc0]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b160
sub eax, edx
cmp eax, 1
jae 0x40b1a4
mov esi, dword [esp + 0xc]
test esi, esi
je 0x40b1af
lea eax, [esp + 0xc0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b180
sub eax, edx
push eax
lea ecx, [esp + 0xc4]
push ecx
push 1
push 0
push 0x6a8214
push esi
call dword [sym.imp.advapi32.dll_RegSetValueExA]
xor esi, esi
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x40b1af
push eax
call edi
call fcn.00406ee0
test eax, eax
je 0x40b468
mov eax, dword [0x6f355c]
mov ebx, dword [0x6f3560]
mov edx, dword [ebp + 8]
mov dword [0x6f3564], eax
mov dword [0x6f356c], eax
xor edi, edi
mov dword [esp + 0x10], eax
cmp dword [0x703c04], edi
mov dword [0x703c00], edx
mov dword [0x6f3568], ebx
mov dword [0x6f3570], ebx
mov dword [esp + 0xc], edi
je 0x40b205
mov dword [esp + 0x14], 0x90000000
jmp 0x40b298
mov esi, dword [sym.imp.user32.dll_GetSystemMetrics]
push 0
mov dword [esp + 0x18], 0x10cf0000
call esi
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [0x6f355c]
cdq
sub eax, edx
sar ecx, 1
sar eax, 1
sub ecx, eax
push 1
mov dword [esp + 0x10], ecx
call esi
cdq
sub eax, edx
mov edi, eax
mov eax, dword [0x6f3560]
cdq
sub eax, edx
sar eax, 1
sar edi, 1
push 4
sub edi, eax
call esi
cdq
sub eax, edx
sar eax, 1
push 0x20
sub edi, eax
call esi
mov ecx, dword [0x6f355c]
lea edx, [ecx + eax*2]
push 0x21
mov dword [esp + 0x14], edx
call esi
push 4
mov ebx, eax
call esi
add eax, dword [0x6f3560]
lea ebx, [eax + ebx*2]
mov eax, dword [esp + 0xc]
test eax, eax
jge 0x40b28c
push 0
mov dword [esp + 0x10], 0
call esi
mov dword [esp + 0x10], eax
test edi, edi
jge 0x40b298
push 1
xor edi, edi
call esi
mov ebx, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
push ebx
push eax
push edi
push ecx
push edx
call fcn.00409380
add esp, 0x14
call dword [sym.imp.winmm.dll_timeGetTime]
push eax
call fcn.005b91c4
add esp, 4
call fcn.00409c10
test eax, eax
jne 0x40b2de
call fcn.00409270
call fcn.00409190
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0x703bfc]
push 0xa
push eax
call dword [sym.imp.user32.dll_ShowWindow]
mov ecx, dword [0x703bfc]
push ecx
call dword [sym.imp.user32.dll_UpdateWindow]
mov edx, dword [0x703bfc]
push edx
call dword [sym.imp.user32.dll_SetFocus]
push 1
call fcn.00405840
fstp st(0)
push 0
call dword [sym.imp.user32.dll_SetCursor]
cmp dword [0x6f3558], 2
mov dword [0x703bac], 0x40b560
je 0x40b334
mov dword [0x703bac], 0x408a50
xor esi, esi
call dword [0x703bac]
test eax, eax
jne 0x40b336
push 5
call fcn.00405840
fstp dword [0x703c10]
cmp dword [0x703c20], esi
je 0x40b368
push 1
call fcn.00405840
fstp dword [0x703c14]
mov dword [0x703c20], esi
push 6
call fcn.00405840
fst dword [0x703c14]
fcomp dword [0x6a75fc]
fnstsw ax
test ah, 0x41
jp 0x40b38c
mov dword [0x703c14], 0x3d4ccccd
mov eax, dword [0x6f3558]
cmp eax, 1
je 0x40b3a0
cmp eax, 4
je 0x40b3a0
cmp eax, 8
jne 0x40b3bd
fld dword [0x703c14]
fcomp dword [0x6a8210]
fnstsw ax
test ah, 0x41
jne 0x40b3bd
mov dword [0x703c14], 0x3dcccccd
fld dword [0x6f3580]
fsub dword [0x703c14]
fst dword [0x6f3580]
fcomp dword [0x6a75fc]
fnstsw ax
test ah, 5
jp 0x40b3e6
mov dword [0x6f3580], 0
cmp dword [0x703c08], esi
je 0x40b425
cmp dword [0x703c0c], esi
je 0x40b425
mov eax, dword [0x21f1c70]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp eax, 0x88760869
jne 0x40b336
mov ecx, 0x21f1c78
call fcn.00533430
test eax, eax
je 0x40b447
mov dword [0x703c0c], esi
jmp 0x40b336
call fcn.00406eb0
test eax, eax
je 0x40b447
cmp dword [0x703c28], esi
jne 0x40b336
call fcn.0042b780
test eax, eax
jne 0x40b336
call fcn.00409270
call fcn.00409190
call fcn.0040ca30
call fcn.005aaf00
push 5
push str.Ending.exe
call dword [sym.imp.kernel32.dll_WinExec]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10