Function at 0x402753
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Persist via run registry key
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x968]
sub esp, 0x9e8
mov eax, dword [0x410eec]
push esi
push 0x411c40
push 0x411830
mov dword [ebp + 0x964], eax
call fcn.00401581
xor esi, esi
cmp eax, esi
pop ecx
pop ecx
mov dword [ebp - 0x40], eax
je 0x402ce2
push ebx
push edi
call fcn.00401e8b
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x3c]
push eax
push 0x2001f
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
mov edi, 0x80000002
push edi
mov dword [ebp - 0x3c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
je 0x4027df
push esi
lea eax, [ebp - 0x3c]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x402900
xor eax, eax
mov word [ebp + 0x748], si
mov ecx, 0x81
lea edi, [ebp + 0x74a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 0x748]
push 0x411c40
push eax
call fcn.004046f5
lea eax, [ebp + 0x748]
push str.Uninstaller.exe
push eax
call fcn.004046cb
lea eax, [ebp + 0x748]
push eax
call fcn.004046b5
add esp, 0x14
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp + 0x748]
push eax
push 1
push esi
push str.DisplayIcon
push dword [ebp - 0x3c]
call ebx
mov edi, 0x40ca28
push edi
call fcn.004046b5
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push esi
push str.DisplayName
push dword [ebp - 0x3c]
call ebx
mov edi, str.http:__fc.xunlei.com
push edi
call fcn.004046b5
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push esi
push str.HelpLink
push dword [ebp - 0x3c]
call ebx
push 0x40c9b8
call fcn.004046b5
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x40c9b8
push 1
push esi
push str.Publisher
push dword [ebp - 0x3c]
call ebx
lea eax, [ebp + 0x748]
push eax
call fcn.004046b5
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp + 0x748]
push eax
push 1
push esi
push str.UninstallString
push dword [ebp - 0x3c]
call ebx
push edi
call fcn.004046b5
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push esi
push str.URLInfoAbout
push dword [ebp - 0x3c]
call ebx
push edi
call fcn.004046b5
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push esi
push str.URLUpdateInfo
push dword [ebp - 0x3c]
call ebx
mov edi, 0x80000002
cmp dword [ebp - 0x3c], esi
je 0x40290e
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x3c]
push eax
push 0x2001f
push esi
push str.SoftwareThunder_NetworkGameDCF_DL
push edi
mov dword [ebp - 0x3c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x402949
push esi
lea eax, [ebp - 0x3c]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push str.SoftwareThunder_NetworkGameDCF_DL
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x402968
mov edi, 0x411c40
push edi
call fcn.004046b5
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push esi
push str.InstDir
push dword [ebp - 0x3c]
call ebx
cmp dword [ebp - 0x3c], esi
je 0x402976
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov word [ebp + 0x748], si
mov ecx, 0x81
lea edi, [ebp + 0x74a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp + 0x950], si
lea edi, [ebp + 0x952]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xa
lea eax, [ebp + 0x950]
push eax
push str.InstallSource
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp + 0x950]
push 0x40c434
push eax
call fcn.0040480d
test eax, eax
pop ecx
pop ecx
jne 0x4029e2
push esi
lea eax, [ebp + 0x748]
push eax
push str.Path
push str.SOFTWAREThunder_NetworkThunderOem_thunder_backwnd
jmp 0x402a0b
lea eax, [ebp + 0x950]
push 0x40c430
push eax
call fcn.0040480d
test eax, eax
pop ecx
pop ecx
jne 0x402a16
push esi
lea eax, [ebp + 0x748]
push eax
push str.Path
push str.SOFTWAREThunder_NetworkXmp
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHRegGetPathW]
lea eax, [ebp + 0x748]
push 0x5c
push eax
call fcn.00404685
test eax, eax
pop ecx
pop ecx
je 0x402a3e
lea eax, [ebp + 0x748]
push 0x5c
push eax
call fcn.00404685
pop ecx
pop ecx
mov word [eax + 2], si
lea eax, [ebp + 0x748]
push str.ThunderFW.exe
push eax
call fcn.004046cb
pop ecx
pop ecx
lea eax, [ebp + 0x748]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x402b28
xor edi, edi
mov dword [ebp - 0x3c], edi
jmp 0x402a71
mov edi, dword [ebp - 0x3c]
lea eax, [ebp + 0x540]
push 0x411c40
push eax
call fcn.004046f5
lea eax, [ebp + 0x540]
push 0x40c398
push eax
call fcn.004046cb
add esp, 0x10
lea eax, [edi + str..FCDLUpdater.exe]
push eax
lea eax, [ebp + 0x540]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0x540]
push eax
lea eax, [edi + 0x410ab8]
push eax
lea eax, [ebp - 0x38]
push str.__s____s_
push eax
call fcn.00404716
add esp, 0x10
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
lea eax, [ebp + 0x748]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x7c], 0x40
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add dword [ebp - 0x3c], 0x208
cmp dword [ebp - 0x3c], 0x410
jb 0x402a6e
push esi
push 0x19
lea eax, [ebp + 0x540]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
jne 0x402bde
xor eax, eax
mov word [ebp + 0x748], si
mov ecx, 0x81
lea edi, [ebp + 0x74a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 0x748]
push 0x411c40
push eax
call fcn.004046f5
lea eax, [ebp + 0x748]
push 0x40c398
push eax
call fcn.004046cb
lea eax, [ebp + 0x748]
push str.FCDownloader.exe
push eax
call fcn.004046cb
add esp, 0x18
push 0x40c7e8
lea eax, [ebp + 0x540]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0x540]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402bc0
lea eax, [ebp + 0x540]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
lea eax, [ebp + 0x748]
push eax
push esi
push 0x40c7d4
push eax
lea eax, [ebp + 0x540]
push eax
call fcn.00401762
add esp, 0x18
lea eax, [ebp + 0x748]
push 0x411c40
push eax
call fcn.004046f5
lea eax, [ebp + 0x748]
push 0x40c398
push eax
call fcn.004046cb
lea eax, [ebp + 0x748]
push str.FCDownloader.exe
push eax
call fcn.004046cb
lea eax, [ebp + 0x748]
push str.__onboot
push eax
call fcn.004046cb
lea eax, [ebp + 0x748]
push eax
call fcn.004046b5
add esp, 0x24
shl eax, 1
push eax
lea eax, [ebp + 0x748]
push eax
push 1
push str.FCDownloader
push str.SoftwareMicrosoftWindowsCurrentVersionRun
mov edi, 0x80000001
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 0x3c]
push eax
push 0x2001f
push esi
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push edi
mov dword [ebp - 0x3c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402cbe
mov ecx, 0x81
lea edi, [ebp + 0x542]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp + 0x540]
push eax
push esi
mov word [ebp + 0x540], si
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp word [ebp + 0x540], si
mov dword [ebp - 0x44], 1
je 0x402cbe
push 4
lea eax, [ebp - 0x44]
push eax
push 4
push esi
lea eax, [ebp + 0x540]
push eax
push dword [ebp - 0x3c]
call ebx
cmp dword [ebp - 0x3c], esi
pop edi
pop ebx
je 0x402cce
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push esi
call fcn.00402654
pop ecx
pop ecx
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 0x964]
mov eax, dword [ebp - 0x40]
pop esi
call fcn.00403dcb
add ebp, 0x968
leave
ret