Function at 0x411f00
Capabilities:
Check for peb beingdebugged flag
Delete file
Resolve function by parsing pe exports
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x492e97
mov eax, dword fs:[0]
push eax
sub esp, 0x48c
mov eax, dword [0x4bb190]
xor eax, esp
mov dword [esp + 0x488], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bb190]
xor eax, esp
push eax
lea eax, [esp + 0x4a0]
mov dword fs:[0], eax
xor esi, esi
xor eax, eax
mov word [esp + 0x20], ax
mov edi, ecx
mov ebx, 7
mov eax, 0x4bd788
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x411f60
sub eax, edx
sar eax, 1
push eax
push 0x4bd788
lea ecx, [esp + 0x24]
call fcn.00402220
mov eax, dword [esp + 0x20]
mov ebp, 8
mov dword [esp + 0x4a8], esi
cmp dword [esp + 0x34], ebp
jae 0x411f98
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [0x4b93a8]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x20], 1
call fcn.004077c0
add esp, 0xc
push 0xffffffffffffffff
push esi
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x4b4], 1
call fcn.00402120
mov byte [esp + 0x4a8], 0
cmp dword [esp + 0x6c], ebp
jb 0x411ff0
mov ecx, dword [esp + 0x58]
push ecx
call fcn.004440cb
add esp, 4
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x34], ebp
jae 0x411ffe
lea eax, [esp + 0x20]
push esi
push eax
call fcn.00467fa5
add esp, 8
test eax, eax
jne 0x412021
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x34], ebp
jae 0x41201a
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, edi
call fcn.004119d0
xor edx, edx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x84], esi
mov word [esp + 0x74], dx
mov ecx, dword [edi + 0x2b4]
sub ecx, dword [edi + 0x2b0]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push 0x49b42c
lea ecx, [esp + 0x94]
push 0x104
push ecx
mov byte [esp + 0x4b8], 2
call fcn.00467806
lea eax, [esp + 0x9c]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x412087
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x90]
push edx
lea ecx, [esp + 0x78]
call fcn.00402220
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x34], ebp
jae 0x4120b6
lea ecx, [esp + 0x20]
mov eax, dword [esp + 0x74]
cmp dword [esp + 0x88], ebp
jae 0x4120c7
lea eax, [esp + 0x74]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push ecx
push eax
push str.LocalGameCount
push str.PARAM
call ebx
push 0xffffffffffffffff
push esi
lea eax, [edi + 0x270]
push eax
lea ecx, [esp + 0x7c]
call fcn.00402120
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x34], ebp
jae 0x4120fc
lea ecx, [esp + 0x20]
mov eax, dword [esp + 0x74]
cmp dword [esp + 0x88], ebp
jae 0x41210d
lea eax, [esp + 0x74]
push ecx
push eax
push str.LastGame
push str.PARAM
call ebx
cmp dword [edi + 0x360], esi
jne 0x412135
push 0xd
push str.FashionSilver
lea ecx, [edi + 0x34c]
call fcn.00402220
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x34], ebp
jae 0x412143
lea ecx, [esp + 0x20]
cmp dword [edi + 0x364], ebp
jb 0x412153
mov eax, dword [edi + 0x350]
jmp 0x412159
lea eax, [edi + 0x350]
push ecx
push eax
push str.DefSkin
push str.PARAM
call ebx
mov esi, dword [edi + 0x2b0]
cmp esi, dword [edi + 0x2b4]
jbe 0x41217a
call fcn.00467a4e
mov ebp, dword [edi + 0x2a4]
mov eax, dword [esp + 0x18]
mov edi, dword [eax + 0x2b4]
cmp dword [eax + 0x2b0], edi
jbe 0x41219b
call fcn.00467a4e
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x2a4]
test ebp, ebp
je 0x4121a9
cmp ebp, eax
je 0x4121ae
call fcn.00467a4e
cmp esi, edi
je 0x41244e
xor edi, edi
xor ecx, ecx
mov dword [esp + 0x6c], 7
mov dword [esp + 0x68], edi
mov word [esp + 0x58], cx
mov edx, dword [esp + 0x14]
push edx
push str.Game_d
lea eax, [esp + 0x29c]
push 0x104
push eax
mov byte [esp + 0x4b8], 3
call fcn.00467806
lea eax, [esp + 0x2a4]
add esp, 0x10
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x412200
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x298]
push ecx
lea ecx, [esp + 0x5c]
call fcn.00402220
xor edx, edx
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], edi
mov word [esp + 0x3c], dx
mov byte [esp + 0x4a8], 4
cmp ebp, edi
jne 0x41231f
call fcn.00467a4e
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x412255
call fcn.00467a4e
push 0xffffffffffffffff
push 0
push esi
lea ecx, [esp + 0x44]
call fcn.00402120
mov edx, dword [esp + 0x20]
mov edi, 8
cmp dword [esp + 0x34], edi
jae 0x412276
lea edx, [esp + 0x20]
mov ecx, dword [esp + 0x3c]
cmp dword [esp + 0x50], edi
jae 0x412284
lea ecx, [esp + 0x3c]
mov eax, dword [esp + 0x58]
cmp dword [esp + 0x6c], edi
jae 0x412292
lea eax, [esp + 0x58]
push edx
push ecx
push str.Name
push eax
call ebx
test ebp, ebp
jne 0x412327
call fcn.00467a4e
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x4122b5
call fcn.00467a4e
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x1c]
push eax
lea ecx, [esp + 0x44]
call fcn.00402120
mov edx, dword [esp + 0x20]
cmp dword [esp + 0x34], edi
jae 0x4122d4
lea edx, [esp + 0x20]
mov ecx, dword [esp + 0x3c]
cmp dword [esp + 0x50], edi
jae 0x4122e2
lea ecx, [esp + 0x3c]
mov eax, dword [esp + 0x58]
cmp dword [esp + 0x6c], edi
jae 0x4122f0
lea eax, [esp + 0x58]
push edx
push ecx
push str.Type
push eax
call ebx
test ebp, ebp
jne 0x41232f
call fcn.00467a4e
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x41230f
call fcn.00467a4e
mov eax, dword [esi + 0x38]
test eax, eax
jne 0x412334
push 6
push str.MMORPG
jmp 0x412340
mov eax, dword [ebp]
jmp 0x41224b
mov eax, dword [ebp]
jmp 0x4122ab
mov eax, dword [ebp]
jmp 0x412305
cmp eax, 1
jne 0x412349
push 7
push str.WEBGAME
lea ecx, [esp + 0x40]
call fcn.00402220
mov edx, dword [esp + 0x20]
cmp dword [esp + 0x34], edi
jae 0x412357
lea edx, [esp + 0x20]
mov ecx, dword [esp + 0x3c]
cmp dword [esp + 0x50], edi
jae 0x412365
lea ecx, [esp + 0x3c]
mov eax, dword [esp + 0x58]
cmp dword [esp + 0x6c], edi
jae 0x412373
lea eax, [esp + 0x58]
push edx
push ecx
push str.Group
push eax
call ebx
test ebp, ebp
jne 0x412441
call fcn.00467a4e
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x412396
call fcn.00467a4e
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x3c]
push ecx
lea ecx, [esp + 0x44]
call fcn.00402120
mov edx, dword [esp + 0x20]
cmp dword [esp + 0x34], edi
jae 0x4123b5
lea edx, [esp + 0x20]
mov ecx, dword [esp + 0x3c]
cmp dword [esp + 0x50], edi
jae 0x4123c3
lea ecx, [esp + 0x3c]
mov eax, dword [esp + 0x58]
cmp dword [esp + 0x6c], edi
jae 0x4123d1
lea eax, [esp + 0x58]
push edx
push ecx
push str.Path
push eax
call ebx
cmp dword [esp + 0x50], edi
jb 0x4123ee
mov edx, dword [esp + 0x3c]
push edx
call fcn.004440cb
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
mov byte [esp + 0x4a8], 2
cmp dword [esp + 0x6c], edi
jb 0x412420
mov ecx, dword [esp + 0x58]
push ecx
call fcn.004440cb
add esp, 4
test ebp, ebp
jne 0x412449
call fcn.00467a4e
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x412435
call fcn.00467a4e
add esi, 0x58
inc dword [esp + 0x14]
jmp 0x412180
mov eax, dword [ebp]
jmp 0x41238c
mov eax, dword [ebp]
jmp 0x41242b
cmp dword [esp + 0x88], 8
jb 0x412465
mov edx, dword [esp + 0x74]
push edx
call fcn.004440cb
add esp, 4
xor eax, eax
cmp dword [esp + 0x34], 8
mov dword [esp + 0x88], 7
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
jb 0x412496
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004440cb
add esp, 4
mov ecx, dword [esp + 0x4a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x488]
xor ecx, esp
call fcn.004677ab
add esp, 0x498
ret