Function at 0x417920
Capabilities:
Check if file exists
Create process on windows
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x49115c
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x4b99e4]
xor eax, esp
mov dword [esp + 0x144], eax
push esi
push edi
mov eax, dword [0x4b99e4]
xor eax, esp
push eax
lea eax, [esp + 0x154]
mov dword fs:[0], eax
call fcn.0040d1e0
mov ecx, eax
call fcn.00408250
push str.SetSougouDefaultToThunder
push 2
call fcn.0040d1e0
mov ecx, eax
call fcn.0040e0a0
test eax, eax
je 0x417981
add eax, 8
jmp 0x417983
xor eax, eax
push str.Enter_
push eax
call fcn.0040d500
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.0040d990
mov ecx, esi
call fcn.0040c6d0
call fcn.0040d1e0
mov ecx, eax
call fcn.00408270
call fcn.004175d0
test eax, eax
jne 0x417a3d
call fcn.0040d1e0
mov ecx, eax
call fcn.00408250
push str.SetSougouDefaultToThunder
push 2
call fcn.0040d1e0
mov ecx, eax
call fcn.0040e0a0
test eax, eax
je 0x4179e4
add eax, 8
jmp 0x4179e6
xor eax, eax
push str.Have_not_Install_Sougou_
push eax
call fcn.0040d500
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.0040d990
mov ecx, esi
call fcn.0040c6d0
call fcn.0040d1e0
mov ecx, eax
call fcn.00408270
cmp dword [esp + 0x164], 0
jne 0x417d6a
push 0x40
push 0x498908
push 0x4998e0
call fcn.00401000
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x417d6a
call fcn.004176a0
mov edi, eax
call fcn.0040d1e0
mov ecx, eax
call fcn.00408250
push str.SetSougouDefaultToThunder
push 2
call fcn.0040d1e0
mov ecx, eax
call fcn.0040e0a0
test eax, eax
je 0x417a6c
add eax, 8
jmp 0x417a6e
xor eax, eax
push edi
push str.GetSougouVersion_nVersion_
push eax
call fcn.0040d500
add esp, 8
mov ecx, eax
call fcn.0040f370
mov esi, eax
push 0xa
mov ecx, esi
call fcn.0040d990
mov ecx, esi
call fcn.0040c6d0
call fcn.0040d1e0
mov ecx, eax
call fcn.00408270
cmp edi, 4
jge 0x417ad2
cmp dword [esp + 0x164], 0
jne 0x417d6a
push 0x30
push 0x498908
push 0x499870
call fcn.00401000
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x417d6a
push 0x497b54
lea ecx, [esp + 0x34]
call fcn.00403330
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x160], 0
call fcn.00417800
add esp, 4
xor ecx, ecx
push 0xffffffffffffffff
push ecx
lea edx, [esp + 0x38]
mov word [esp + 0x20], cx
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], 0
call fcn.00402a70
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [esp + 0x15c], 1
mov edi, 8
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], edi
jae 0x417b41
lea eax, [esp + 0x18]
push eax
call esi
test eax, eax
je 0x417b5a
push 1
push 0x49919c
lea ecx, [esp + 0x1c]
call fcn.00417340
jmp 0x417b33
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], edi
jae 0x417b68
lea eax, [esp + 0x34]
push eax
call esi
test eax, eax
je 0x417b95
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x2c], edi
jae 0x417b7d
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], edi
jae 0x417b8b
lea eax, [esp + 0x34]
push ecx
push eax
call fcn.0044fb85
add esp, 8
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], edi
jae 0x417ba3
lea eax, [esp + 0x18]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x104
lea eax, [esp + 0x50]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str..._thunder.sext
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
call fcn.0040d1e0
mov ecx, eax
call fcn.00408250
push str.SetSougouDefaultToThunder
push 2
call fcn.0040d1e0
mov ecx, eax
call fcn.0040e0a0
test eax, eax
je 0x417bf8
add eax, 8
jmp 0x417bfa
xor eax, eax
lea edx, [esp + 0x4c]
push edx
push str.Sougou_Extension_Path_is_
push eax
call fcn.0040d500
add esp, 8
push eax
call fcn.0040d500
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.0040d990
mov ecx, esi
call fcn.0040c6d0
call fcn.0040d1e0
mov ecx, eax
call fcn.00408270
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea eax, [esp + 0x4c]
push eax
call esi
test eax, eax
jne 0x417ca0
call fcn.0040d1e0
mov ecx, eax
call fcn.00408250
push str.SetSougouDefaultToThunder
push 2
call fcn.0040d1e0
mov ecx, eax
call fcn.0040e0a0
test eax, eax
je 0x417c6d
add eax, 8
jmp 0x417c6f
xor eax, eax
push str.Sougou_Extension_Path_not_Exist_
push eax
call fcn.0040d500
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.0040d990
mov ecx, esi
call fcn.0040c6d0
call fcn.0040d1e0
mov ecx, eax
call fcn.00408270
jmp 0x417d58
push 0x4993fc
lea ecx, [esp + 0x14]
call fcn.0040f1b0
lea ecx, [esp + 0x4c]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x160], 2
call fcn.00410c20
push 0x4993fc
lea ecx, [esp + 0x14]
call fcn.00410c20
push 0x497a4e
lea ecx, [esp + 0x10]
call fcn.0040f1b0
lea edx, [esp + 0xc]
push edx
mov byte [esp + 0x160], 3
call fcn.004174c0
mov eax, dword [esp + 0x10]
add esp, 4
push eax
call esi
test eax, eax
je 0x417d46
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 1
push 0
push ecx
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0xc]
call fcn.0040ed40
lea ecx, [esp + 0x10]
call fcn.0040ed40
lea ecx, [esp + 0x14]
call fcn.004022e0
lea ecx, [esp + 0x30]
call fcn.004022e0
mov eax, 1
jmp 0x417d6c
lea ecx, [esp + 0xc]
call fcn.0040ed40
lea ecx, [esp + 0x10]
call fcn.0040ed40
lea ecx, [esp + 0x14]
call fcn.004022e0
lea ecx, [esp + 0x30]
call fcn.004022e0
xor eax, eax
mov ecx, dword [esp + 0x154]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0044c23d
add esp, 0x154
ret