Function at 0x418350
Capabilities:
Create process on windows
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x447dd6
mov eax, dword fs:[0]
push eax
sub esp, 0x660
mov eax, dword [0x465d44]
xor eax, esp
mov dword [esp + 0x65c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x465d44]
xor eax, esp
push eax
lea eax, [esp + 0x674]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push 0x802
mov esi, ecx
mov eax, dword [esi + 0x58]
push 0xb08
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esi + 0x50], 8
jb 0x4183af
mov eax, dword [esi + 0x3c]
jmp 0x4183b2
lea eax, [esi + 0x3c]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.UninstallXLWFP.exe
push eax
lea ecx, [esp + 0x60]
push ecx
call ebp
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x20], ebx
call fcn.0041ec20
add esp, 8
cmp dword [esp + 0x18], ebx
je 0x418423
push ebx
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x44f5d0
lea edx, [esp + 0x68]
push 0x44f664
push edx
mov dword [esp + 0x2c], ebx
call fcn.00413ae0
mov ecx, eax
call fcn.00413000
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x418418
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 7
xor ecx, ecx
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], cx
cmp dword [esi + 0x50], 8
mov dword [esp + 0x67c], ebx
jb 0x418449
mov eax, dword [esi + 0x3c]
jmp 0x41844c
lea eax, [esi + 0x3c]
push str.program_thunder.exe
push eax
lea edx, [esp + 0x470]
push edx
call ebp
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x46c]
push ecx
call fcn.0041f240
mov eax, dword [esp + 0x48]
add esp, 8
cmp dword [esp + 0x54], 8
jae 0x418480
lea eax, [esp + 0x40]
push eax
push 0x44f5d0
call fcn.00413ae0
mov ecx, eax
call fcn.00411fd0
xor edx, edx
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], dx
lea eax, [esp + 0x20]
push eax
push str.CommonFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x68c], 1
call fcn.00420260
mov eax, dword [esp + 0x34]
add esp, 0x10
cmp dword [esp + 0x38], 8
jae 0x4184d4
lea eax, [esp + 0x24]
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
push 0x44f5d0
push eax
call edi
test eax, eax
jne 0x4184f6
push 0x1d
push str.C:Program_FilesCommon_Files
lea ecx, [esp + 0x28]
call fcn.0040376d
cmp dword [esp + 0x38], 8
mov eax, dword [esp + 0x24]
jae 0x418505
lea eax, [esp + 0x24]
push str.Thunder_NetworkKankanPusherUninst.exe
push eax
lea ecx, [esp + 0x268]
push ecx
call ebp
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x264]
push eax
mov dword [esp + 0x24], ebx
call fcn.0041ec20
add esp, 8
mov ecx, esi
call fcn.00417cb0
mov ecx, esi
call fcn.004155d0
lea ecx, [esi + 0x1c]
push ecx
mov ecx, esi
call fcn.00416cc0
mov ecx, esi
call fcn.004148a0
mov ecx, esi
call fcn.00415a60
mov ecx, esi
call fcn.004146c0
mov ecx, esi
call fcn.00416870
mov ecx, esi
call fcn.00416380
cmp dword [esp + 0x1c], ebx
je 0x41858b
push ebx
push ebx
push str._S__from_XL79
lea edx, [esp + 0x26c]
push edx
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, esi
call fcn.004144e0
mov ecx, esi
call fcn.00415d80
call fcn.0040e8c0
add eax, 0xb4
mov ebp, 8
cmp dword [eax + 0x18], ebp
jb 0x4185b2
mov eax, dword [eax + 4]
jmp 0x4185b5
add eax, 4
push 0x44f664
push eax
call edi
test eax, eax
jne 0x4185d1
push 1
call fcn.0040e8c0
mov ecx, eax
call fcn.0040d0e0
jmp 0x4185e6
mov eax, dword [esi + 0x58]
push ebx
push 0x803
push 0xb08
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 0x38], ebp
jb 0x4185f9
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00430dfa
add esp, 4
xor edx, edx
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], dx
cmp dword [esp + 0x54], ebp
jb 0x41861f
mov eax, dword [esp + 0x40]
push eax
call fcn.00430dfa
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x674]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x65c]
xor ecx, esp
call fcn.004310bf
add esp, 0x66c
ret