Function at 0x408c07
Capabilities:
Delete file
Get common file path
Initialize winsock library
Reference cloudflare dns server
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x414
mov eax, dword [0x445bbc]
xor eax, esp
mov dword [esp + 0x410], eax
mov eax, dword [sym.imp.MSVCR90.dll___argc]
mov eax, dword [eax]
push ebx
push esi
push edi
push 4
pop ebx
cmp eax, ebx
jne 0x40905a
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
lea esi, [esp + 0x10]
call fcn.00413585
lea eax, [esp + 0x80]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor eax, eax
push 0x206
mov word [esp + 0x214], ax
xor edi, edi
lea eax, [esp + 0x216]
push edi
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [esp + 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.Thunder_Networkxlliveud_
lea eax, [esp + 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x210]
push eax
call dword [sym.imp.XLBugHandler.dll__XL_SetBugReportRootDir_4]
cmp dword [esp + 0x28], 0x10
mov eax, dword [esp + 0x14]
jae 0x408cc1
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.XLBugHandler.dll__XL_SetPeerID_4]
push str.1.0.0.7
push str.xlliveud
push edi
push edi
push str.XLLiveUpdate
call dword [sym.imp.XLBugHandler.dll__XL_InitBugHandler_20]
push edi
call dword [sym.imp.XLBugHandler.dll__XL_SetReportShowMode_4]
test byte [0x446e54], 1
jne 0x408cf6
call fcn.004010b4
jmp 0x408cfb
mov eax, 0x446e58
mov ecx, dword [sym.imp.MSVCR90.dll___wargv]
mov edx, dword [ecx]
push dword [edx + 0xc]
mov edx, dword [edx + 8]
mov ecx, eax
call fcn.00403d57
test al, al
je 0x409007
test byte [0x446e54], 1
jne 0x408d28
call fcn.004010b4
jmp 0x408d2d
mov eax, 0x446e58
mov esi, eax
call fcn.0040439f
test al, al
je 0x409007
lea eax, [esp + 0x2c]
push str.LiveUpdate_stat.xml
push eax
call fcn.004173a0
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__]
push eax
lea ecx, [esp + 0x68]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [esp + 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea eax, [esp + 0x2c]
push str.LiveUpdate_storage.xml
push eax
call fcn.004173a0
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__]
push eax
lea ecx, [esp + 0x4c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [esp + 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
cmp dword [esp + 0x60], 8
mov edx, dword [esp + 0x4c]
jae 0x408da5
lea edx, [esp + 0x4c]
cmp dword [esp + 0x7c], 8
mov ecx, dword [esp + 0x68]
jae 0x408db4
lea ecx, [esp + 0x68]
cmp dword [esp + 0x28], 0x10
mov eax, dword [esp + 0x14]
jae 0x408dc3
lea eax, [esp + 0x14]
lea esi, [esp + 0xc]
push esi
push edx
push ecx
push str.http:__nohost_LiveUpdate_stat.xml
push edi
push eax
push str.1.0.0.1
push 0x4391bc
push 0x3f7
call dword [sym.imp.xlstat.dll_XLSTAT_Init]
mov eax, dword [sym.imp.MSVCR90.dll___wargv]
mov eax, dword [eax]
mov esi, dword [eax + 4]
mov ecx, 0x4391c8
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408e1b
cmp dx, di
je 0x408e17
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408e1b
add eax, ebx
add ecx, ebx
cmp dx, di
jne 0x408df7
xor eax, eax
jmp 0x408e20
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x408e3d
test byte [0x446e54], 1
jne 0x408e34
call fcn.004010b4
jmp 0x408e39
mov eax, 0x446e58
xor edx, edx
jmp 0x408e89
mov ecx, 0x4391d0
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408e68
cmp dx, di
je 0x408e64
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408e68
add eax, ebx
add ecx, ebx
cmp dx, di
jne 0x408e44
xor eax, eax
jmp 0x408e6d
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x408e94
test byte [0x446e54], 1
jne 0x408e81
call fcn.004010b4
jmp 0x408e86
mov eax, 0x446e58
xor edx, edx
inc edx
push eax
call fcn.004048e7
jmp 0x408fe5
mov ecx, 0x438d28
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408ebf
cmp dx, di
je 0x408ebb
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408ebf
add eax, ebx
add ecx, ebx
cmp dx, di
jne 0x408e9b
xor eax, eax
jmp 0x408ec4
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x408ee9
test byte [0x446e54], 1
jne 0x408ed8
call fcn.004010b4
jmp 0x408edd
mov eax, 0x446e58
mov ebx, eax
call fcn.0040473f
jmp 0x408fe5
mov ecx, 0x4391d8
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408f14
cmp dx, di
je 0x408f10
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408f14
add eax, ebx
add ecx, ebx
cmp dx, di
jne 0x408ef0
xor eax, eax
jmp 0x408f19
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x408fe5
call fcn.00408b6f
call fcn.00411281
test byte [0x446e54], 1
jne 0x408f3b
call fcn.004010b4
jmp 0x408f40
mov eax, 0x446e58
mov esi, eax
call fcn.00406574
test al, al
je 0x408fc5
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x408f86
cmp dword [esp + 0x30], 0x401
jne 0x408f70
push 1
push edi
call fcn.00401569
xor ecx, ecx
mov edi, eax
call fcn.0040144d
xor edi, edi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push edi
push edi
push edi
lea eax, [esp + 0x38]
push eax
call esi
test eax, eax
jne 0x408f53
test byte [0x446e54], 1
jne 0x408fa4
call fcn.004010b4
jmp 0x408fa9
mov eax, 0x446e58
mov esi, eax
call fcn.004042ca
push edi
call dword [sym.imp.xlstat.dll_XLSTAT_Uninit]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.004112bf
push edi
call dword [sym.imp.XLUE.dll_XLUE_Uninit]
push edi
call dword [sym.imp.XLUE.dll_XLUE_UninitLuaHost]
call dword [sym.imp.XLGraphic.dll_XL_UnInitGraphicLib]
push edi
call dword [sym.imp.XLUE.dll_XLUE_UninitHandleMap]
push edi
call dword [sym.imp.xlstat.dll_XLSTAT_SyncSendAllStat]
push edi
call dword [sym.imp.xlstat.dll_XLSTAT_Uninit]
lea ecx, [esp + 0x48]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x64]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
test byte [0x446e54], 1
jne 0x409017
call fcn.004010b4
jmp 0x40901c
mov eax, 0x446e58
mov esi, eax
call fcn.004042ca
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test byte [0x446e54], 1
jne 0x409041
call fcn.004010b4
jmp 0x409046
mov eax, 0x446e58
call fcn.00404312
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
jmp 0x40917c
cmp eax, 5
jne 0x40917c
mov eax, dword [sym.imp.MSVCR90.dll___wargv]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, 0x4391e0
mov cx, word [eax]
cmp cx, word [edx]
jne 0x409096
test cx, cx
je 0x409092
mov cx, word [eax + 2]
cmp cx, word [edx + 2]
jne 0x409096
add eax, ebx
add edx, ebx
test cx, cx
jne 0x409072
xor eax, eax
jmp 0x40909b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40917c
lea ecx, [esp + 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esp + 0x48]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov eax, dword [sym.imp.MSVCR90.dll___wargv]
mov eax, dword [eax]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
push dword [eax + 0x10]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea ebx, [esp + 0x2c]
call fcn.00415798
mov ecx, dword [esp + 0x30]
add esp, 0x1c
cmp dword [esp + 0x28], 8
jae 0x4090f5
lea ecx, [esp + 0x14]
mov eax, dword [sym.imp.MSVCR90.dll___wargv]
mov eax, dword [eax]
mov ebx, dword [eax + 0xc]
mov edi, dword [eax + 8]
push ecx
lea esi, [esp + 0x30]
call fcn.00413851
cmp dword [esp + 0x2c], 8
pop ecx
mov ecx, dword [esp + 0x14]
jae 0x40911c
lea ecx, [esp + 0x14]
mov eax, dword [sym.imp.MSVCR90.dll___wargv]
mov eax, dword [eax]
mov ebx, dword [eax + 0xc]
mov edi, dword [eax + 8]
push ecx
lea esi, [esp + 0x4c]
call fcn.0041571f
cmp dword [esp + 0x48], 8
mov eax, dword [esp + 0x34]
pop ecx
jae 0x409143
lea eax, [esp + 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
cmp dword [esp + 0x60], 8
mov eax, dword [esp + 0x4c]
jae 0x40915b
lea eax, [esp + 0x4c]
push eax
call esi
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x48]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0042898c
mov esp, ebp
pop ebp
ret 0x10