Function at 0x416f30
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x442ad6
mov eax, dword fs:[0]
push eax
sub esp, 0x450
mov eax, dword [0x45ea14]
xor eax, esp
mov dword [esp + 0x44c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45ea14]
xor eax, esp
push eax
lea eax, [esp + 0x464]
mov dword fs:[0], eax
xor edi, edi
push edi
push 0x802
mov esi, ecx
mov eax, dword [esi + 0x58]
push 0xb08
push eax
call dword [0x44935c]
xor ecx, ecx
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], edi
mov word [esp + 0x38], cx
mov ebp, 8
mov dword [esp + 0x46c], edi
cmp dword [esi + 0x50], ebp
jb 0x416fad
mov eax, dword [esi + 0x3c]
jmp 0x416fb0
lea eax, [esi + 0x3c]
mov ebx, dword [0x449318]
push str.program_thunder.exe
push eax
lea edx, [esp + 0x260]
push edx
call ebx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x25c]
push ecx
call fcn.0041ccd0
mov eax, dword [esp + 0x40]
add esp, 8
cmp dword [esp + 0x4c], ebp
jae 0x416fe9
lea eax, [esp + 0x38]
push eax
push 0x4495c0
call fcn.004124f0
mov ecx, eax
call fcn.00410ba0
xor edx, edx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], dx
lea eax, [esp + 0x18]
push eax
push str.CommonFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
mov byte [esp + 0x47c], 1
call fcn.0041dc00
mov eax, dword [esp + 0x2c]
add esp, 0x10
cmp dword [esp + 0x30], ebp
jae 0x417040
lea eax, [esp + 0x1c]
mov ebp, dword [0x4492e8]
push 0x4495c0
push eax
call ebp
test eax, eax
jne 0x417062
push 0x1d
push str.C:Program_FilesCommon_Files
lea ecx, [esp + 0x20]
call fcn.004036d1
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x417071
lea eax, [esp + 0x1c]
push str.Thunder_NetworkKankanPusherUninst.exe
push eax
lea ecx, [esp + 0x58]
push ecx
call ebx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x54]
push eax
mov dword [esp + 0x1c], edi
call fcn.0041c6b0
add esp, 8
mov ecx, esi
call fcn.00416890
mov ecx, esi
call fcn.00413df0
lea ecx, [esi + 0x1c]
push ecx
mov ecx, esi
call fcn.00415740
mov ecx, esi
call fcn.004130e0
mov ecx, esi
call fcn.00414280
mov ecx, esi
call fcn.00412f00
mov ecx, esi
call fcn.00415240
mov ecx, esi
call fcn.00414ba0
cmp dword [esp + 0x14], edi
je 0x4170ee
push edi
push edi
push str._S__from_XL79
lea edx, [esp + 0x5c]
push edx
push str.open
push edi
call dword [0x4492e0]
mov ecx, esi
call fcn.00412d20
mov ecx, esi
call fcn.004145a0
call fcn.0040e670
add eax, 0xb4
mov ebx, 8
cmp dword [eax + 0x18], ebx
jb 0x417115
mov eax, dword [eax + 4]
jmp 0x417118
add eax, 4
push 0x449654
push eax
call ebp
test eax, eax
jne 0x417142
push 4
call fcn.0040e670
mov ecx, eax
call fcn.0040dd90
push 1
call fcn.0040e670
mov ecx, eax
call fcn.0040c850
jmp 0x417157
mov eax, dword [esi + 0x58]
push edi
push 0x803
push 0xb08
push eax
call dword [0x44935c]
cmp dword [esp + 0x30], ebx
jb 0x41716a
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0042c02e
add esp, 4
xor edx, edx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], dx
cmp dword [esp + 0x4c], ebx
jb 0x417190
mov eax, dword [esp + 0x38]
push eax
call fcn.0042c02e
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x464]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44c]
xor ecx, esp
call fcn.0042c2f3
add esp, 0x45c
ret