Function at 0x401240
Capabilities:
Check if file exists
Create directory
Create process on windows
Delete directory
Delete file
Get common file path
Print debug messages
Set registry value

Disassembly:
sub esp, 0x558
push ebx
xor ebx, ebx
push str.23DF975A_FBBF_4952_93D3_3C6AD98117EB
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, ebx
mov dword [0x410ea0], eax
je 0x40159e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40159e
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x465]
mov byte [esp + 0x464], bl
push 0x104
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x570]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x468]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x401346
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea edx, [esp + 0x10]
push edx
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push 0x80000001
mov dword [esp + 0x1c], ebx
call ebp
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40130c
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 4
push eax
push 4
lea ecx, [esp + 0x470]
push ebx
push ecx
push edx
mov dword [esp + 0x2c], 1
call esi
mov eax, dword [esp + 0x10]
push eax
call edi
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push 0x80000001
call ebp
test eax, eax
jne 0x401346
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push 4
push edx
push 4
push ebx
push str.SIGN.IE0216D0_KankanXInstaller.exe
push eax
mov dword [esp + 0x2c], 1
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x159]
mov byte [esp + 0x158], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x158]
push edx
push 0x104
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [esp + 0x158]
push str..KKXITemp
push eax
call ebp
lea ecx, [esp + 0x158]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, 0x41
lea esi, [esp + 0x158]
lea edi, [esp + 0x360]
lea edx, [esp + 0x360]
push str..xinstaller.cab
push edx
rep movsd dword es:[edi], dword [esi]
call ebp
mov ecx, 0x41
lea esi, [esp + 0x158]
lea edi, [esp + 0x25c]
lea eax, [esp + 0x25c]
push str..xinstallercopy.bat
push eax
rep movsd dword es:[edi], dword [esi]
call ebp
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea ecx, [esp + 0x25c]
push ecx
call esi
test eax, eax
jne 0x40140d
lea edx, [esp + 0x25c]
push edx
push 0x40e190
push 0x84
call fcn.00401180
add esp, 0xc
lea eax, [esp + 0x360]
push eax
call esi
test eax, eax
jne 0x401435
lea ecx, [esp + 0x360]
push ecx
push 0x40e18c
push 0x83
call fcn.00401180
add esp, 0xc
lea edx, [esp + 0x25c]
push edx
call esi
cmp eax, 1
jne 0x4014de
lea eax, [esp + 0x360]
push eax
call esi
cmp eax, 1
jne 0x4014de
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x25c]
push edx
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x20], 0x40
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push 0x1388
mov eax, dword [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x360]
push ecx
call edi
lea edx, [esp + 0x25c]
push edx
call edi
lea eax, [esp + 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x55]
mov byte [esp + 0x54], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
lea ecx, [esp + 0x58]
push 0x2b
push ecx
push ebx
stosb byte es:[edi], al
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jl 0x40157f
lea edx, [esp + 0x54]
push str.Thunder_Network
push edx
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [esp + 0x54]
push ebx
push eax
call edi
lea ecx, [esp + 0x54]
push str.Kankan
push ecx
call ebp
lea edx, [esp + 0x54]
push ebx
push edx
call edi
lea eax, [esp + 0x54]
push str..kankan.ico
push eax
call ebp
lea ecx, [esp + 0x54]
push ecx
call esi
test eax, eax
jne 0x40156d
lea edx, [esp + 0x54]
push edx
push str.ICO_TMP
push 0x8a
call fcn.00401180
add esp, 0xc
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esp + 0x54]
push ecx
push str.http:__www.xunlei.com__id601
call fcn.00401080
add esp, 8
mov edx, dword [0x410ea0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x558
ret 0x10
xor eax, eax
pop ebx
add esp, 0x558
ret 0x10