Function at 0x4037fc
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Get installed programs
Persist via run registry key
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x40b617
call fcn.00405214
sub esp, 0xc00
mov eax, dword [0x410eec]
push ebx
push 0x411c40
push 0x411830
mov dword [ebp - 0x10], eax
call fcn.004015bb
xor ebx, ebx
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xbcc], eax
je 0x403f59
push esi
push edi
call fcn.00401ec5
push 0x1a
pop ecx
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
lea edi, [ebp - 0x434]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xbcc], eax
movsw word es:[edi], word [esi]
push 0x67
pop ecx
xor eax, eax
lea edi, [ebp - 0x3ca]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x434]
push 0x40cbfc
push eax
call fcn.00404a2b
pop ecx
pop ecx
lea eax, [ebp - 0xbb8]
push eax
mov edi, 0x2001f
push edi
push ebx
lea eax, [ebp - 0x434]
push eax
push 0x80000002
mov dword [ebp - 0xbb8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
je 0x4038ce
push ebx
lea eax, [ebp - 0xbb8]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x434]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x403a04
xor eax, eax
mov word [ebp - 0x22c], bx
mov ecx, 0x81
lea edi, [ebp - 0x22a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x22c]
push 0x411c40
push eax
call fcn.00404a55
lea eax, [ebp - 0x22c]
push str.Uninstaller.exe
push eax
call fcn.00404a2b
lea eax, [ebp - 0x22c]
push eax
call fcn.00404a15
add esp, 0x14
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x22c]
push eax
push 1
push ebx
push str.DisplayIcon
push dword [ebp - 0xbb8]
call esi
mov edi, 0x40cbfc
push edi
call fcn.00404a15
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push ebx
push str.DisplayName
push dword [ebp - 0xbb8]
call esi
mov edi, str.http:__xm.xunlei.com
push edi
call fcn.00404a15
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push ebx
push str.HelpLink
push dword [ebp - 0xbb8]
call esi
push 0x40cb50
call fcn.00404a15
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x40cb50
push 1
push ebx
push str.Publisher
push dword [ebp - 0xbb8]
call esi
lea eax, [ebp - 0x22c]
push eax
call fcn.00404a15
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x22c]
push eax
push 1
push ebx
push str.UninstallString
push dword [ebp - 0xbb8]
call esi
push edi
call fcn.00404a15
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push ebx
push str.URLInfoAbout
push dword [ebp - 0xbb8]
call esi
push edi
call fcn.00404a15
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push ebx
push str.URLUpdateInfo
push dword [ebp - 0xbb8]
call esi
mov edi, 0x2001f
cmp dword [ebp - 0xbb8], ebx
je 0x403a18
push dword [ebp - 0xbb8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xbb8]
push eax
push edi
push ebx
push str.SoftwareThunder_NetworkGameXM_DL
push 0x80000002
mov dword [ebp - 0xbb8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x403a5c
push ebx
lea eax, [ebp - 0xbb8]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push str.SoftwareThunder_NetworkGameXM_DL
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x403a7e
mov edi, 0x411c40
push edi
call fcn.00404a15
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push ebx
push str.InstDir
push dword [ebp - 0xbb8]
call esi
cmp dword [ebp - 0xbb8], ebx
je 0x403a92
push dword [ebp - 0xbb8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov word [ebp - 0x22c], bx
mov ecx, 0x81
lea edi, [ebp - 0x22a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x24], bx
lea edi, [ebp - 0x22]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xa
lea eax, [ebp - 0x24]
push eax
push str.InstallSource
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x24]
push 0x40c434
push eax
call fcn.00404b6d
test eax, eax
pop ecx
pop ecx
jne 0x403af2
push ebx
lea eax, [ebp - 0x22c]
push eax
push str.Path
push str.SOFTWAREThunder_NetworkThunderOem_thunder_backwnd
jmp 0x403b18
lea eax, [ebp - 0x24]
push 0x40c430
push eax
call fcn.00404b6d
test eax, eax
pop ecx
pop ecx
jne 0x403b23
push ebx
lea eax, [ebp - 0x22c]
push eax
push str.Path
push str.SOFTWAREThunder_NetworkXmp
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHRegGetPathW]
lea eax, [ebp - 0x22c]
push 0x5c
push eax
call fcn.004049e5
test eax, eax
pop ecx
pop ecx
je 0x403b4b
lea eax, [ebp - 0x22c]
push 0x5c
push eax
call fcn.004049e5
pop ecx
pop ecx
mov word [eax + 2], bx
lea eax, [ebp - 0x22c]
push str.ThunderFW.exe
push eax
call fcn.00404a2b
pop ecx
pop ecx
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x403c6b
xor edi, edi
mov dword [ebp - 0xbb8], edi
jmp 0x403b84
mov edi, dword [ebp - 0xbb8]
lea eax, [ebp - 0x63c]
push 0x411c40
push eax
call fcn.00404a55
lea eax, [ebp - 0x63c]
push 0x40c398
push eax
call fcn.00404a2b
add esp, 0x10
lea eax, [edi + str..XMDLUpdater.exe]
push eax
lea eax, [ebp - 0x63c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x63c]
push eax
lea eax, [edi + 0x410ab8]
push eax
lea eax, [ebp - 0xbb4]
push str.__s____s_
push eax
call fcn.00404a76
add esp, 0x10
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0xc08]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0xbfc], eax
lea eax, [ebp - 0xbb4]
mov dword [ebp - 0xbf8], eax
lea eax, [ebp - 0xc0c]
push eax
mov dword [ebp - 0xc0c], 0x3c
mov dword [ebp - 0xc08], 0x40
mov dword [ebp - 0xc04], ebx
mov dword [ebp - 0xc00], ebx
mov dword [ebp - 0xbf4], ebx
mov dword [ebp - 0xbf0], ebx
mov dword [ebp - 0xbec], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [ebp - 0xbd4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add dword [ebp - 0xbb8], 0x208
cmp dword [ebp - 0xbb8], 0x410
jb 0x403b7e
push ebx
push 0x19
lea eax, [ebp - 0x434]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
jne 0x403e40
xor eax, eax
mov word [ebp - 0x22c], bx
mov ecx, 0x81
lea edi, [ebp - 0x22a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x22c]
push 0x411c40
push eax
call fcn.00404a55
lea eax, [ebp - 0x22c]
push 0x40c398
push eax
call fcn.00404a2b
lea eax, [ebp - 0x22c]
push str.XMDownloader.exe
push eax
call fcn.00404a2b
add esp, 0x18
push 0x40caa4
lea ecx, [ebp - 0xbbc]
call fcn.00402d89
push 0x40ca9c
lea ecx, [ebp - 0xbc0]
mov dword [ebp - 4], ebx
call fcn.00402fa9
mov edi, 0x40ca94
push edi
push eax
lea eax, [ebp - 0xbc8]
push eax
mov byte [ebp - 4], 1
call fcn.00402c7a
lea ecx, [ebp - 0xbbc]
push ecx
push eax
lea eax, [ebp - 0xbc4]
push eax
mov byte [ebp - 4], 2
call fcn.00402c0a
add esp, 0x18
push dword [eax]
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, dword [ebp - 0xbc4]
add ecx, 0xfffffff0
call fcn.00401369
mov ecx, dword [ebp - 0xbc8]
add ecx, 0xfffffff0
call fcn.00401369
mov ecx, dword [ebp - 0xbc0]
add ecx, 0xfffffff0
call fcn.00401369
mov ecx, dword [ebp - 0xbbc]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00401369
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403d91
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x40ca88
lea ecx, [ebp - 0xbbc]
call fcn.00402d89
push 0x40ca84
lea ecx, [ebp - 0xbc4]
mov dword [ebp - 4], 3
call fcn.00402fa9
push edi
push eax
lea eax, [ebp - 0xbc8]
push eax
mov byte [ebp - 4], 4
call fcn.00402c7a
lea ecx, [ebp - 0xbbc]
push ecx
push eax
lea eax, [ebp - 0xbc0]
push eax
mov byte [ebp - 4], 5
call fcn.00402c0a
mov eax, dword [eax]
push ebx
lea ecx, [ebp - 0x22c]
push ecx
push ebx
push eax
mov eax, ecx
push eax
lea eax, [ebp - 0x434]
push eax
mov byte [ebp - 4], 6
call fcn.0040179c
mov ecx, dword [ebp - 0xbc0]
add esp, 0x30
add ecx, 0xfffffff0
call fcn.00401369
mov ecx, dword [ebp - 0xbc8]
add ecx, 0xfffffff0
call fcn.00401369
mov ecx, dword [ebp - 0xbc4]
add ecx, 0xfffffff0
call fcn.00401369
mov ecx, dword [ebp - 0xbbc]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00401369
lea eax, [ebp - 0x22c]
push 0x411c40
push eax
call fcn.00404a55
lea eax, [ebp - 0x22c]
push 0x40c398
push eax
call fcn.00404a2b
lea eax, [ebp - 0x22c]
push str.XMDownloader.exe
push eax
call fcn.00404a2b
lea eax, [ebp - 0x22c]
push str.__onboot
push eax
call fcn.00404a2b
lea eax, [ebp - 0x22c]
push eax
call fcn.00404a15
add esp, 0x24
shl eax, 1
push eax
lea eax, [ebp - 0x22c]
push eax
push 1
push str.XMDownloader
push str.SoftwareMicrosoftWindowsCurrentVersionRun
mov edi, 0x80000001
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 0xbb8]
push eax
push 0x2001f
push ebx
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push edi
mov dword [ebp - 0xbb8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403f2f
mov ecx, 0x81
lea edi, [ebp - 0x63a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x63c]
push eax
push ebx
mov word [ebp - 0x63c], bx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp word [ebp - 0x63c], bx
mov dword [ebp - 0xbd0], 1
je 0x403f2f
push 4
lea eax, [ebp - 0xbd0]
push eax
push 4
push ebx
lea eax, [ebp - 0x63c]
push eax
push dword [ebp - 0xbb8]
call esi
cmp dword [ebp - 0xbb8], ebx
pop edi
pop esi
je 0x403f45
push dword [ebp - 0xbb8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
call fcn.004026dc
pop ecx
pop ecx
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xbcc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0040412d
leave
ret