Function at 0x40cc48
Capabilities:
Check if file exists
Create process on windows
Delete directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46e81a
mov eax, dword fs:[0]
push eax
sub esp, 0x8c0
mov eax, dword [0x4879c0]
xor eax, esp
mov dword [esp + 0x8b8], eax
push ebx
push esi
push edi
mov eax, dword [0x4879c0]
xor eax, esp
push eax
lea eax, [esp + 0x8d0]
mov dword fs:[0], eax
call fcn.0040662a
push str._XLInstallProgramXLGamebox.exe
lea ecx, [esp + 0x34]
mov dword [eax], 1
call fcn.004036a3
lea eax, [esp + 0x30]
xor esi, esi
push eax
mov dword [esp + 0x8dc], esi
call fcn.0040662a
push eax
call fcn.00406828
call fcn.0040662a
lea ecx, [esp + 0x30]
call fcn.00406725
push str._XLInstallUninstaller.exe
lea ecx, [esp + 0x6c]
call fcn.004036a3
lea eax, [esp + 0x68]
push eax
mov byte [esp + 0x8dc], 1
call fcn.0040662a
push eax
call fcn.00406828
call fcn.0040662a
lea ecx, [esp + 0x68]
call fcn.00406725
push str._XLInstallProgramHome.ico
lea ecx, [esp + 0x50]
call fcn.004036a3
lea eax, [esp + 0x4c]
push eax
mov byte [esp + 0x8dc], 2
call fcn.0040662a
push eax
call fcn.00406828
call fcn.0040662a
lea ecx, [esp + 0x4c]
call fcn.00406725
mov ebx, 0x206
cmp dword [ebp + 8], esi
je 0x40ce64
xor eax, eax
push ebx
mov word [esp + 0x6c0], ax
lea eax, [esp + 0x6c2]
push esi
push eax
call fcn.00431530
add esp, 0xc
lea eax, [esp + 0x6bc]
push eax
push esi
push esi
push 0x10
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x479b18
lea eax, [esp + 0x6c0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x6bc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40cda0
lea eax, [esp + 0x6bc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
push ebx
mov word [esp + 0x2b0], ax
lea eax, [esp + 0x2b2]
push esi
push eax
call fcn.00431530
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push esi
push 0x19
lea eax, [esp + 0x2b4]
push eax
push esi
call edi
cmp eax, 1
jne 0x40ce08
push 0x479b18
lea eax, [esp + 0x2b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x2ac]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40ce08
lea eax, [esp + 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x48], 8
mov ecx, dword [esp + 0x34]
jae 0x40ce17
lea ecx, [esp + 0x34]
push esi
mov eax, 0x477e98
push eax
push eax
push str._b_startfrom_Desktop
push ecx
lea eax, [esp + 0x6d0]
push eax
lea eax, [esp + 0x9c]
push eax
call fcn.004055da
lea ecx, [esp + 0x84]
mov byte [esp + 0x8d8], 3
call fcn.00404ad1
lea ecx, [esp + 0x84]
mov byte [esp + 0x8d8], 2
call fcn.00405667
jmp 0x40ce6a
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
push ebx
mov word [esp + 0x2b0], ax
lea eax, [esp + 0x2b2]
push esi
push eax
call fcn.00431530
add esp, 0xc
push esi
push 2
lea eax, [esp + 0x2b4]
push eax
push esi
call edi
cmp eax, 1
jne 0x40d190
xor eax, eax
push ebx
mov word [esp + 0x4b8], ax
lea eax, [esp + 0x4ba]
push esi
push eax
call fcn.00431530
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push 0x479b60
lea eax, [esp + 0x2b0]
push eax
lea eax, [esp + 0x4bc]
push eax
call edi
lea eax, [esp + 0x4b4]
push eax
lea ecx, [esp + 0x18]
call fcn.004036a3
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x8dc], 4
call fcn.0040b3cd
pop ecx
push esi
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x8e0], 2
call fcn.00403f22
push 0x479b7c
lea eax, [esp + 0x2b0]
push eax
lea eax, [esp + 0x4bc]
push eax
call edi
lea eax, [esp + 0x4b4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
push ebx
mov word [esp + 0x6c0], ax
lea eax, [esp + 0x6c2]
push esi
push eax
call fcn.00431530
add esp, 0xc
push 0x479b88
lea eax, [esp + 0x2b0]
push eax
lea eax, [esp + 0x6c4]
push eax
call edi
lea eax, [esp + 0x6bc]
push eax
lea ecx, [esp + 0x18]
call fcn.004036a3
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x8dc], 5
call fcn.0040b3cd
pop ecx
push esi
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x8e0], 2
call fcn.00403f22
push 0x479bac
lea eax, [esp + 0x2b0]
push eax
lea eax, [esp + 0x6c4]
push eax
call edi
lea eax, [esp + 0x6bc]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [esp + 0x2ac]
push 0x479bc0
push eax
lea eax, [esp + 0x6c4]
push eax
call edi
lea eax, [esp + 0x6bc]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x479bcc
lea eax, [esp + 0x2b0]
push eax
call edi
lea eax, [esp + 0x2ac]
push eax
lea ecx, [esp + 0x18]
call fcn.004036a3
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x8dc], 6
call fcn.0040b3cd
pop ecx
push esi
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x8e0], 2
call fcn.00403f22
lea eax, [esp + 0x2ac]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40d056
lea eax, [esp + 0x2ac]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 0x479be0
lea eax, [esp + 0x2b0]
push eax
call edi
cmp dword [esp + 0x48], 8
mov eax, dword [esp + 0x34]
jae 0x40d074
lea eax, [esp + 0x34]
push esi
push 0x479650
mov edi, 0x477e98
push edi
push str._b_startfrom_StartMenu
push eax
lea eax, [esp + 0x2c0]
push eax
lea eax, [esp + 0x154]
push eax
call fcn.004055da
lea ecx, [esp + 0x13c]
mov byte [esp + 0x8d8], 7
call fcn.00404ad1
push 0x479c2c
lea eax, [esp + 0x2b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp dword [esp + 0x80], 8
mov eax, dword [esp + 0x6c]
jae 0x40d0d4
lea eax, [esp + 0x6c]
push esi
push 0x479650
push edi
push edi
push eax
lea eax, [esp + 0x2c0]
push eax
lea eax, [esp + 0x20c]
push eax
call fcn.004055da
lea ecx, [esp + 0x1f4]
mov byte [esp + 0x8d8], 8
call fcn.00404ad1
push str....lnk
lea eax, [esp + 0x2b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp dword [esp + 0x64], 8
mov eax, dword [esp + 0x50]
jae 0x40d128
lea eax, [esp + 0x50]
push esi
push 0x479c70
push eax
push edi
push str.http:__gamebox.niu.xunlei.com_
lea eax, [esp + 0x2c0]
push eax
lea eax, [esp + 0x9c]
push eax
call fcn.004055da
lea ecx, [esp + 0x84]
mov byte [esp + 0x8d8], 9
call fcn.00404ad1
lea ecx, [esp + 0x84]
call fcn.00405667
lea ecx, [esp + 0x1f4]
call fcn.00405667
lea ecx, [esp + 0x13c]
mov byte [esp + 0x8d8], 2
call fcn.00405667
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp dword [ebp + 0xc], 1
jne 0x40d2fb
call fcn.0041292c
test eax, eax
je 0x40d1fc
xor eax, eax
push ebx
mov word [esp + 0x4b8], ax
lea eax, [esp + 0x4ba]
push esi
push eax
call fcn.00431530
add esp, 0xc
push esi
push 0x19
lea eax, [esp + 0x4bc]
push eax
push esi
call edi
cmp eax, 1
jne 0x40d2fb
push 0x479b18
lea eax, [esp + 0x4b8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 1
push esi
push esi
lea eax, [esp + 0x4c0]
push eax
push str.pintostartscreen
jmp 0x40d25d
call fcn.0040cbcb
push ebx
push esi
cmp eax, 1
jne 0x40d269
xor eax, eax
mov word [esp + 0x4bc], ax
lea eax, [esp + 0x4be]
push eax
call fcn.00431530
add esp, 0xc
push esi
push 0x10
lea eax, [esp + 0x4bc]
push eax
push esi
call edi
cmp eax, 1
jne 0x40d2fb
push 0x479b18
lea eax, [esp + 0x4b8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 1
push esi
push esi
lea eax, [esp + 0x4c0]
push eax
push str.taskbarpin
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40d2fb
xor eax, eax
mov word [esp + 0x4bc], ax
lea eax, [esp + 0x4be]
push eax
call fcn.00431530
add esp, 0xc
push esi
push 0x1a
lea eax, [esp + 0x4bc]
push eax
push esi
call edi
cmp eax, 1
jne 0x40d2fb
push str..MicrosoftInternet_ExplorerQuick_Launch_
lea eax, [esp + 0x4b8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp dword [esp + 0x48], 8
mov ecx, dword [esp + 0x34]
jae 0x40d2b8
lea ecx, [esp + 0x34]
push esi
mov eax, 0x477e98
push eax
push eax
push str._b_startfrom_QuickLaunch
push ecx
lea eax, [esp + 0x4c8]
push eax
lea eax, [esp + 0x154]
push eax
call fcn.004055da
lea ecx, [esp + 0x13c]
mov byte [esp + 0x8d8], 0xa
call fcn.00404ad1
lea ecx, [esp + 0x13c]
call fcn.00405667
push esi
push esi
push 0x2000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push esi
push 1
lea ecx, [esp + 0x54]
call fcn.00403f22
push esi
push 1
lea ecx, [esp + 0x70]
call fcn.00403f22
push esi
push 1
lea ecx, [esp + 0x38]
call fcn.00403f22
mov ecx, dword [esp + 0x8d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8b8]
xor ecx, esp
call fcn.0042ea9f
mov esp, ebp
pop ebp
ret