Function at 0x40a060
Capabilities:
Check if file exists
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c963
mov eax, dword fs:[0]
push eax
sub esp, 0xd18
mov eax, dword [0x437640]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xd24], ecx
cmp dword [ebp + 8], 0x1388
jne 0x40a136
push 0x42ea08
lea ecx, [ebp - 0xd04]
call fcn.00405180
mov dword [ebp - 4], 0
lea eax, [ebp - 0xd04]
push eax
lea ecx, [ebp - 0x124]
call fcn.00403630
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xd04]
call fcn.00402e00
push str._rNZPHr_gl
lea ecx, [ebp - 0xd08]
call fcn.00405180
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xd08]
push ecx
lea ecx, [ebp - 0x124]
call fcn.004040a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xd08]
call fcn.00402e00
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x124]
call fcn.0040c080
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x124]
call fcn.00403740
jmp 0x40a687
cmp dword [ebp + 8], 0x1389
jne 0x40a154
push 6
mov ecx, dword [ebp - 0xd24]
sub ecx, 0x24
call fcn.00407450
jmp 0x40a687
cmp dword [ebp + 8], 0x138a
jne 0x40a651
xor edx, edx
mov word [ebp - 0xb54], dx
push 0x206
push 0
lea eax, [ebp - 0xb52]
push eax
call fcn.004138c0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0xb54]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0xb54]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov ecx, dword [ebp - 0xd24]
add ecx, 0x16c
call fcn.0040bbe0
cmp eax, 0xa
jne 0x40a263
push 0x42ea08
lea ecx, [ebp - 0xd0c]
call fcn.00405180
mov dword [ebp - 4], 4
lea eax, [ebp - 0xd0c]
push eax
lea ecx, [ebp - 0xc24]
call fcn.00405ca0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xd0c]
call fcn.00402e00
push 0x42ebf8
lea ecx, [ebp - 0xd10]
call fcn.00405180
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd10]
push ecx
lea ecx, [ebp - 0xc24]
call fcn.00406240
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xd10]
call fcn.00402e00
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0xc24]
call fcn.0040c2a0
mov dword [ebp - 0xd14], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc24]
call fcn.00405da0
mov eax, dword [ebp - 0xd14]
jmp 0x40a689
mov edx, dword [ebp - 0xd24]
add edx, 0x154
push edx
mov ecx, dword [ebp - 0xd24]
add ecx, 0x16c
call fcn.0040bbe0
lea eax, [eax*4 + 0x4385f4]
push eax
call fcn.0040bf20
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40a344
push 0x42ea08
lea ecx, [ebp - 0xd18]
call fcn.00405180
mov dword [ebp - 4], 8
lea edx, [ebp - 0xd18]
push edx
lea ecx, [ebp - 0xcf4]
call fcn.00405ca0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xd18]
call fcn.00402e00
push 0x42ebd0
lea ecx, [ebp - 0xd1c]
call fcn.00405180
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0xd1c]
push eax
lea ecx, [ebp - 0xcf4]
call fcn.00406240
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xd1c]
call fcn.00402e00
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0xcf4]
call fcn.0040c2a0
mov dword [ebp - 0xd20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcf4]
call fcn.00405da0
mov eax, dword [ebp - 0xd20]
jmp 0x40a689
lea ecx, [ebp - 0xb54]
push ecx
mov ecx, dword [ebp - 0xd24]
sub ecx, 0x28
call fcn.0040a800
push 1
lea edx, [ebp - 0xb54]
push edx
push 0x42ebc8
push str.Xbsd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0xd24]
sub ecx, 0x28
call fcn.0040a6b0
xor eax, eax
mov word [ebp - 0x94c], ax
push 0x206
push 0
lea ecx, [ebp - 0x94a]
push ecx
call fcn.004138c0
add esp, 0xc
lea edx, [ebp - 0xb54]
push edx
push 0x104
lea eax, [ebp - 0x94c]
push eax
call fcn.00413852
add esp, 0xc
push str.Data_strategy.dat
lea ecx, [ebp - 0x94c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x94c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40a3f1
lea eax, [ebp - 0x94c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
mov word [ebp - 0x32c], cx
push 0x206
push 0
lea edx, [ebp - 0x32a]
push edx
call fcn.004138c0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x744], ax
push 0x206
push 0
lea ecx, [ebp - 0x742]
push ecx
call fcn.004138c0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x53c], dx
push 0x206
push 0
lea eax, [ebp - 0x53a]
push eax
call fcn.004138c0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x32c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x32c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x32c]
push eax
push 0x104
lea ecx, [ebp - 0x744]
push ecx
call fcn.00413852
add esp, 0xc
lea edx, [ebp - 0x32c]
push edx
push 0x104
lea eax, [ebp - 0x53c]
push eax
call fcn.00413852
add esp, 0xc
push str.XbMain.dll
lea ecx, [ebp - 0x744]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.DataUser.dat
lea edx, [ebp - 0x53c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x744]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40a622
lea ecx, [ebp - 0x744]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0xcfc], eax
push 0x42eb40
mov edx, dword [ebp - 0xcfc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xcf8], eax
mov eax, dword [ebp - 0xd24]
add eax, 0x160
push eax
push 0x42eb30
call dword [ebp - 0xcf8]
mov ecx, dword [ebp - 0xd24]
cmp dword [ecx + 0x160], 0
je 0x40a622
lea edx, [ebp - 0x53c]
push edx
mov eax, dword [ebp - 0xd24]
mov ecx, dword [eax + 0x160]
mov edx, dword [ebp - 0xd24]
mov eax, dword [edx + 0x160]
mov ecx, dword [ecx]
push eax
mov edx, dword [ecx + 0xc]
call edx
mov ecx, dword [ebp - 0xd24]
add ecx, 0x164
call fcn.00402da0
movzx eax, al
test eax, eax
jne 0x40a5ae
mov ecx, dword [ebp - 0xd24]
add ecx, 0x164
call fcn.00403050
push eax
push str.ProductID
push str.BaseInfo
mov ecx, dword [ebp - 0xd24]
mov edx, dword [ecx + 0x160]
mov eax, dword [ebp - 0xd24]
mov ecx, dword [eax + 0x160]
mov edx, dword [edx]
push ecx
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [ebp - 0xd24]
add ecx, 0x168
call fcn.00402da0
movzx ecx, al
test ecx, ecx
jne 0x40a602
mov ecx, dword [ebp - 0xd24]
add ecx, 0x168
call fcn.00403050
push eax
push str.Channel
push str.BaseInfo
mov edx, dword [ebp - 0xd24]
mov eax, dword [edx + 0x160]
mov ecx, dword [ebp - 0xd24]
mov edx, dword [ecx + 0x160]
mov eax, dword [eax]
push edx
mov ecx, dword [eax + 0x10]
call ecx
push 1
lea edx, [ebp - 0xb54]
push edx
push str._CrcCheck
push str.xblive.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x330], 0
lea eax, [ebp - 0x330]
push eax
mov ecx, dword [ebp - 0xd24]
mov edx, dword [ecx - 0x24]
push edx
push 0
push 0
mov ecx, dword [ebp - 0xd24]
sub ecx, 0x28
call fcn.00409310
jmp 0x40a687
cmp dword [ebp + 8], 0x138b
jne 0x40a687
mov dword [ebp - 0xd00], 0
lea eax, [ebp - 0xd00]
push eax
mov ecx, dword [ebp - 0xd24]
mov edx, dword [ecx - 0x24]
push edx
push 0
push 0
mov ecx, dword [ebp - 0xd24]
sub ecx, 0x28
call fcn.00409310
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413171
mov esp, ebp
pop ebp
ret 4