Function at 0x40654f
Capabilities:
Check mutex on windows
Create process on windows
Delete file
Enumerate files on windows
Print debug messages

Disassembly:
mov eax, 0x422eb7
call fcn.00422230
sub esp, 0x30c
mov eax, dword [0x430520]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor eax, ebp
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
xor esi, esi
lea eax, [ebp - 0x2b4]
push esi
push eax
call fcn.0041da02
push str.liveupdate_prop.txt
push eax
lea eax, [ebp - 0x2b0]
push eax
mov dword [ebp - 4], esi
call fcn.004026da
add esp, 0x14
push dword [eax]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov ecx, dword [ebp - 0x2b0]
add ecx, 0xfffffff0
call fcn.004021e8
mov ecx, dword [ebp - 0x2b4]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.004021e8
push str.THUNDER_LOG_HOME
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea eax, [ebp - 0x29c]
push esi
push eax
mov byte [ebp - 4], 5
call fcn.0041da02
pop ecx
pop ecx
push dword [eax]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov ecx, dword [ebp - 0x29c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 5
call fcn.004021e8
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x406616
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR71.dll__wputenv]
lea eax, [ebp - 0x29c]
push eax
call fcn.0041dafb
push 0x430608
push eax
call fcn.004063bc
mov ecx, dword [ebp - 0x29c]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004021e8
push esi
push edi
push esi
mov ecx, 0x4305d0
call fcn.0040600a
push ebx
mov dword [0x4305c8], edi
call fcn.0040a251
mov ecx, eax
call fcn.00409b25
test eax, eax
jne 0x406683
push esi
push str.LiveUpdate
push str.Incorrect_command_line_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
or esi, 0xffffffff
jmp 0x4069d4
call fcn.0040a251
mov ecx, eax
call fcn.00408ea7
mov edi, 0x430600
push eax
mov ecx, edi
call fcn.004032bb
push str.Global_
lea ecx, [ebp - 0x2a0]
call fcn.00405488
push str..EC042B9A_354D_4CCF_B2CF_53ED0DEBB49F
lea eax, [ebp - 0x29c]
push edi
push eax
mov byte [ebp - 4], 7
call fcn.004026da
add esp, 0xc
push eax
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 8
call fcn.00406537
mov ecx, dword [ebp - 0x29c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 7
call fcn.004021e8
push dword [ebp - 0x2a0]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x29c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
lea ecx, [ebp - 0x2a4]
jne 0x40677f
push str.LiveUpdate_ERROR_ALREADY_EXISTS
call fcn.00405488
push dword [ebp - 0x2a4]
mov byte [ebp - 4], 9
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.0040a251
mov ecx, eax
call fcn.00408e21
test eax, eax
je 0x40676c
push dword [0x430600]
push dword [0x430840]
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
cmp edi, esi
je 0x40676c
push esi
call fcn.0040a251
mov ecx, eax
call fcn.00408e13
push eax
push dword [0x430844]
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x2a4]
add ecx, 0xfffffff0
call fcn.004021e8
jmp 0x4069c6
push str.LiveUpdate__ERROR_ALREADY_EXISTS
call fcn.00405488
push dword [ebp - 0x2a4]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x2a4]
add ecx, 0xfffffff0
call fcn.004021e8
call fcn.00405fe4
lea ecx, [ebp - 0x318]
call fcn.0040a9fc
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x2ac], esp
mov dword [eax], esi
push esi
push closesocket
push dword [0x430600]
mov dword [ebp - 0x2c4], esi
push ecx
mov eax, esp
lea ecx, [ebp - 0x2c4]
mov dword [ebp - 0x2c0], esi
mov dword [ebp - 0x2bc], esi
mov dword [ebp - 0x2b8], esi
mov dword [ebp - 0x2ac], esp
mov dword [eax], ecx
push esi
lea ecx, [ebp - 0x318]
mov byte [ebp - 4], 0xa
call fcn.004063d9
cmp eax, esi
mov dword [0x4305cc], eax
jne 0x40682f
lea ecx, [ebp - 0x318]
mov byte [ebp - 4], 7
call fcn.0040a7df
mov ecx, dword [ebp - 0x2a0]
add ecx, 0xfffffff0
call fcn.004021e8
jmp 0x40667b
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x406851
lea eax, [ebp - 0x2e0]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2e0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
lea eax, [ebp - 0x2e0]
push esi
push eax
call edi
test eax, eax
jne 0x406837
push dword [ebp - 0x314]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0x427aa0
mov edi, 0x430614
lea eax, [ebp - 0x2a4]
push edi
push eax
call fcn.004026da
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x298]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x2a4]
add ecx, 0xfffffff0
mov ebx, eax
call fcn.004021e8
cmp ebx, 0xffffffff
je 0x406943
push 0xffffffffffffffff
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x2bc]
call fcn.00406137
lea eax, [ebp - 0x2a8]
push eax
call fcn.004062ef
mov eax, dword [ebp - 0x2a8]
sub eax, dword [ebp - 0x2bc]
mov ecx, dword [ebp - 0x2a4]
sbb ecx, dword [ebp - 0x2b8]
push esi
push 0x15180
push ecx
push eax
call fcn.004223b0
cmp edx, esi
jl 0x40692d
jg 0x406900
cmp eax, 0xa
jb 0x40692d
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x2ac]
push edi
push eax
call fcn.004026da
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x2ac]
add ecx, 0xfffffff0
call fcn.004021e8
lea eax, [ebp - 0x298]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4068b0
call fcn.0040a251
mov ecx, eax
call fcn.00408e10
cmp eax, 0xb
je 0x406976
call fcn.0040a251
mov ecx, eax
call fcn.00408e10
cmp eax, 0xc
je 0x406976
call fcn.0040a251
mov ecx, eax
call fcn.00408e10
cmp eax, 0xe
jne 0x406999
call fcn.004147b6
cmp dword [eax + 0x2c], esi
jne 0x406999
push 1
push esi
push esi
call fcn.0040a251
mov ecx, eax
call fcn.00408ea3
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0x29c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x29c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x2d8]
lea ecx, [ebp - 0x318]
mov byte [ebp - 4], 7
call fcn.0040a7df
mov ecx, dword [ebp - 0x2a0]
add ecx, 0xfffffff0
call fcn.004021e8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00422213
leave
ret 0x10