Function at 0x456140
Capabilities:
Check if file exists
Create process on windows
Delete file
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46420a
mov eax, dword fs:[0]
push eax
mov eax, 0x16e4
call fcn.0044e520
mov eax, dword [0x4891c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x2c]
call fcn.00401d20
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
push str.Version
push str.SOFTWAREMicrosoftInternet_Explorer
push closesocket
call fcn.004537f0
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.004015b0
movzx ecx, al
test ecx, ecx
jne 0x4561bc
push 0
lea ecx, [ebp - 0x2c]
call fcn.004027b0
movzx edx, word [eax]
cmp edx, 0x39
je 0x4561ca
call fcn.0041adc0
cmp eax, 0xa
jl 0x4562b2
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.0045dde0
mov ecx, eax
call fcn.0045de70
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.004015b0
movzx ecx, al
test ecx, ecx
jne 0x456285
push 0x4772ec
lea ecx, [ebp - 0x48]
call fcn.00401600
push str.http:__windows.microsoft.com_zh_CN_internet_explorer_products_ie_home
lea ecx, [ebp - 0x48]
call fcn.00401600
push 0x4771d4
lea ecx, [ebp - 0x48]
call fcn.00401600
mov dword [ebp - 0xa4], 0x44
push 0x40
push 0
lea edx, [ebp - 0xa0]
push edx
call fcn.0043c260
add esp, 0xc
mov dword [ebp - 0x58], 0
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 0xa4]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x48]
call fcn.00401d50
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x16c6], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.004026a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004026a0
mov al, byte [ebp - 0x16c6]
jmp 0x456840
lea ecx, [ebp - 0x2c]
call fcn.004015b0
movzx edx, al
test edx, edx
jne 0x456824
push 0
lea ecx, [ebp - 0x2c]
call fcn.004027b0
movzx eax, word [eax]
cmp eax, 0x38
je 0x4562ff
push 0
lea ecx, [ebp - 0x2c]
call fcn.004027b0
movzx ecx, word [eax]
cmp ecx, 0x37
je 0x4562ff
push 0
lea ecx, [ebp - 0x2c]
call fcn.004027b0
movzx edx, word [eax]
cmp edx, 0x36
jne 0x456824
push 2
lea eax, [ebp - 0x16e4]
push eax
call fcn.0045dde0
mov ecx, eax
call fcn.0045de70
mov dword [ebp - 0x16ec], eax
mov ecx, dword [ebp - 0x16ec]
mov dword [ebp - 0x16f0], ecx
mov byte [ebp - 4], 2
push str.TempInternetExplorer8_CHS_TEMP.exe
mov edx, dword [ebp - 0x16f0]
push edx
lea eax, [ebp - 0xc0]
push eax
call fcn.004026e0
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x16e4]
call fcn.004026a0
lea ecx, [ebp - 0xc0]
call fcn.00401d50
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x105]
call fcn.00457520
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [ebp - 0xdc]
call fcn.00401d20
mov byte [ebp - 4], 6
call fcn.004536b0
mov dword [ebp - 0xe0], eax
call fcn.00453710
cmp eax, 4
jne 0x45645a
movzx edx, word [ebp - 0x104]
test edx, edx
jne 0x456406
cmp dword [ebp - 0xe0], 1
je 0x4563c7
cmp dword [ebp - 0xe0], 2
jne 0x4563d9
push str.http:__files1.sogou.com_IE8_WindowsXP_x86_CHS.exe
lea ecx, [ebp - 0xdc]
call fcn.00401d00
jmp 0x456404
cmp dword [ebp - 0xe0], 3
jne 0x4563f4
push str.http:__files2.sogou.com_IE8_WindowsXP_x86_CHT.exe
lea ecx, [ebp - 0xdc]
call fcn.00401d00
jmp 0x456404
push str.http:__files2.sogou.com_IE8_WindowsXP_x86_ENU.exe
lea ecx, [ebp - 0xdc]
call fcn.00401d00
jmp 0x456455
cmp dword [ebp - 0xe0], 1
je 0x456418
cmp dword [ebp - 0xe0], 2
jne 0x45642a
push str.http:__files1.sogou.com_IE8_WindowsServer2003_x64_CHS2.exe
lea ecx, [ebp - 0xdc]
call fcn.00401d00
jmp 0x456455
cmp dword [ebp - 0xe0], 3
jne 0x456445
push str.http:__files2.sogou.com_IE8_WindowsServer2003_x64_CHT.exe
lea ecx, [ebp - 0xdc]
call fcn.00401d00
jmp 0x456455
push str.http:__files2.sogou.com_IE8_WindowsServer2003_x64_ENU.exe
lea ecx, [ebp - 0xdc]
call fcn.00401d00
jmp 0x456537
call fcn.00453710
cmp eax, 0x10
jne 0x456537
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x4564d6
cmp dword [ebp - 0xe0], 1
jne 0x45648e
push str.http:__files1.sogou.com_IE8_WindowsVista_x86_CHS2.exe
lea ecx, [ebp - 0xdc]
call fcn.00401d00
jmp 0x4564d4
cmp dword [ebp - 0xe0], 2
jne 0x4564a9
push str.http:__files2.sogou.com_IE8_WindowsVista_x86_ZHH.exe
lea ecx, [ebp - 0xdc]
call fcn.00401d00
jmp 0x4564d4
cmp dword [ebp - 0xe0], 3
jne 0x4564c4
push str.http:__files2.sogou.com_IE8_WindowsVista_x86_CHT.exe
lea ecx, [ebp - 0xdc]
call fcn.00401d00
jmp 0x4564d4
push str.http:__files2.sogou.com_IE8_WindowsVista_x86_ENU.exe
lea ecx, [ebp - 0xdc]
call fcn.00401d00
jmp 0x456537
cmp dword [ebp - 0xe0], 1
jne 0x4564f1
push str.http:__files1.sogou.com_IE8_WindowsVista_x64_CHS.exe
lea ecx, [ebp - 0xdc]
call fcn.00401d00
jmp 0x456537
cmp dword [ebp - 0xe0], 2
jne 0x45650c
push str.http:__files2.sogou.com_IE8_WindowsVista_x64_ZHH.exe
lea ecx, [ebp - 0xdc]
call fcn.00401d00
jmp 0x456537
cmp dword [ebp - 0xe0], 3
jne 0x456527
push str.http:__files2.sogou.com_IE8_WindowsVista_x64_CHT.exe
lea ecx, [ebp - 0xdc]
call fcn.00401d00
jmp 0x456537
push str.http:__files2.sogou.com_IE8_WindowsVista_x64_ENU.exe
lea ecx, [ebp - 0xdc]
call fcn.00401d00
lea ecx, [ebp - 0xdc]
call fcn.004015b0
movzx ecx, al
test ecx, ecx
jne 0x456695
call fcn.0042456f
mov dword [ebp - 0x1650], eax
lea edx, [ebp - 0x166c]
push edx
call fcn.0045e4f0
add esp, 4
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x166c]
call fcn.004015b0
movzx eax, al
test eax, eax
jne 0x456599
lea ecx, [ebp - 0x166c]
call fcn.00405c20
push eax
xor edi, edi
mov eax, dword [ebp - 0x1650]
call fcn.00424690
add esp, 4
push 0
push 1
push 0
call fcn.00453690
push eax
push 0x477384
mov eax, dword [ebp - 0x1650]
call fcn.00424588
add esp, 0x14
lea ecx, [ebp - 0xc0]
call fcn.00401d50
push eax
push 0x46eb4f
lea ecx, [ebp - 0xdc]
call fcn.00401d50
push eax
mov eax, dword [ebp - 0x1650]
call fcn.004245de
add esp, 0xc
mov eax, dword [ebp - 0x1650]
call fcn.0042463e
lea ecx, [ebp - 0x164c]
push ecx
mov eax, dword [ebp - 0x1650]
call fcn.00424653
add esp, 4
lea edx, [ebp - 0x164c]
push edx
lea ecx, [ebp - 0xc0]
call fcn.00401d00
cmp dword [ebp - 0x111c], 2
je 0x45667b
mov byte [ebp - 0x16e5], 0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x166c]
call fcn.00407d30
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xdc]
call fcn.004026a0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x105]
call fcn.00457510
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc0]
call fcn.004026a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004026a0
mov al, byte [ebp - 0x16e5]
jmp 0x456840
mov esi, dword [ebp - 0x1650]
call fcn.004245c7
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x166c]
call fcn.00407d30
lea ecx, [ebp - 0xc0]
call fcn.00401d50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4567ac
call fcn.0041af30
mov byte [ebp - 0x16c5], al
push 0x477434
lea ecx, [ebp - 0x16c4]
call fcn.004024b0
mov byte [ebp - 4], 8
movzx eax, byte [ebp - 0x16c5]
test eax, eax
je 0x4566e3
call fcn.00453710
cmp eax, 0x10
jne 0x4566f3
push str.runas
lea ecx, [ebp - 0x16c4]
call fcn.00401d00
mov dword [ebp - 0x16a8], 0x3c
mov dword [ebp - 0x16a4], 0x40
mov dword [ebp - 0x16a0], 0
lea ecx, [ebp - 0x16c4]
call fcn.00401d50
mov dword [ebp - 0x169c], eax
lea ecx, [ebp - 0xc0]
call fcn.00401d50
mov dword [ebp - 0x1698], eax
mov dword [ebp - 0x1694], 0x477514
mov dword [ebp - 0x1690], 0
mov dword [ebp - 0x168c], 0
xor ecx, ecx
mov dword [ebp - 0x1688], ecx
mov dword [ebp - 0x1684], ecx
mov dword [ebp - 0x1680], ecx
mov dword [ebp - 0x167c], ecx
mov dword [ebp - 0x1678], ecx
mov dword [ebp - 0x1674], ecx
mov dword [ebp - 0x1670], ecx
lea edx, [ebp - 0x16a8]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x45679b
mov eax, dword [ebp - 0x1670]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x16c4]
call fcn.004026a0
jmp 0x4567f7
mov byte [ebp - 0x16e6], 0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xdc]
call fcn.004026a0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x105]
call fcn.00457510
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc0]
call fcn.004026a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004026a0
mov al, byte [ebp - 0x16e6]
jmp 0x456840
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xdc]
call fcn.004026a0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x105]
call fcn.00457510
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc0]
call fcn.004026a0
mov byte [ebp - 0x16e7], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004026a0
mov al, byte [ebp - 0x16e7]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043bc88
mov esp, ebp
pop ebp
ret