Function at 0x498bcb
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a44b4
mov eax, dword fs:[0]
push eax
sub esp, 0x178
mov eax, dword [0x4d406c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x17c], ecx
push 0x4b4008
call fcn.0044169d
add eax, 0x18
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.004098b4
add esp, 0xc
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x15c], eax
and dword [ebp - 4], 0
push 0x4b3fe4
push dword [ebp - 0x15c]
lea eax, [ebp - 0xe8]
push eax
call fcn.00412622
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x100]
call fcn.00408cf0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x180], esp
mov edx, 0x4b400c
call fcn.0041bb55
lea ecx, [ebp - 0xd0]
call fcn.00448f0b
add esp, 0x18
mov dword [ebp - 0x184], eax
mov byte [ebp - 4], 3
call fcn.004154f6
cmp eax, 0xa
jl 0x498d33
push 0x4b4018
lea ecx, [ebp - 0x70]
call fcn.00408923
mov byte [ebp - 4], 4
lea eax, [ebp - 0x70]
push eax
call fcn.0044169d
add eax, 0x18
mov edx, eax
xor cl, cl
call fcn.004494d7
pop ecx
movzx eax, al
test eax, eax
jne 0x498ccd
mov dword [ebp - 0x140], 1
jmp 0x498cd4
and dword [ebp - 0x140], 0
mov al, byte [ebp - 0x140]
mov byte [ebp - 0x131], al
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x70]
call fcn.00408cf0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x498d33
push 0x4b403c
lea ecx, [ebp - 0x88]
call fcn.00408923
mov byte [ebp - 4], 5
lea eax, [ebp - 0x88]
push eax
call fcn.0044169d
add eax, 0x18
mov edx, eax
xor cl, cl
call fcn.00449a8d
pop ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x88]
call fcn.00408cf0
call fcn.004154f6
cmp eax, 0xd
jl 0x498d79
push 0x4b4060
lea ecx, [ebp - 0xa0]
call fcn.00408923
mov byte [ebp - 4], 6
lea eax, [ebp - 0xa0]
push eax
call fcn.0044169d
add eax, 0x18
mov edx, eax
xor cl, cl
call fcn.00449aa2
pop ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xa0]
call fcn.00408cf0
call fcn.00499614
call fcn.004992e2
push str.VideoCache
push str.SoftWareSogouExplorerAccelerater
mov edx, SysReAllocString
lea ecx, [ebp - 0x58]
call fcn.0041ab36
pop ecx
pop ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x58]
call fcn.0040f3b1
movzx eax, al
test eax, eax
jne 0x498db7
lea ecx, [ebp - 0x58]
call fcn.00448180
push 0x4b409c
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov ecx, SysReAllocString
call fcn.0041b1df
pop ecx
mov edx, str.SogouExplorerHTML
mov ecx, SysReAllocString
call fcn.0041b08c
mov edx, 0x4b4180
mov ecx, SysReAllocString
call fcn.0041b08c
mov edx, 0x4b41ec
mov ecx, SysReAllocString
call fcn.0041b08c
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallSogouExplorer
mov ecx, SysReAllocString
call fcn.0041b08c
mov edx, str.SoftwareClasses.seskin
mov ecx, SysReAllocString
call fcn.0041b08c
mov edx, str.SoftwareClasses.setheme
mov ecx, SysReAllocString
call fcn.0041b08c
mov edx, str.SoftwareClasses.sext
mov ecx, SysReAllocString
call fcn.0041b08c
mov edx, str.SoftwareClasses.crx
mov ecx, SysReAllocString
call fcn.0041b08c
mov edx, str.SoftwareClassesSESkinFile
mov ecx, SysReAllocString
call fcn.0041b08c
mov edx, str.SoftwareClassesSEThemeFile
mov ecx, SysReAllocString
call fcn.0041b08c
mov edx, str.SoftwareClassesSEExtensionFile
mov ecx, SysReAllocString
call fcn.0041b08c
mov edx, str.SoftwareClientsStartMenuInternetSogouExplorer.exe
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041b08c
mov edx, str.SoftWareSogouExplorer
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041b08c
call fcn.004995c1
mov edx, str.SoftwareClassesSEPdfFile
mov ecx, SysReAllocString
call fcn.0041b08c
lea ecx, [ebp - 0xe8]
call fcn.00408b05
push eax
lea ecx, [ebp - 0xd0]
call fcn.00408b05
push eax
call fcn.0045f68f
pop ecx
pop ecx
test eax, eax
je 0x498f66
lea ecx, [ebp - 0x178]
call fcn.00407ae3
mov byte [ebp - 4], 8
lea eax, [ebp - 0x178]
push eax
mov edx, 0x4b4538
mov ecx, SysReAllocString
call fcn.0041ad79
pop ecx
movzx eax, al
test eax, eax
je 0x498f57
lea ecx, [ebp - 0x178]
call fcn.004115e4
mov dword [ebp - 0x160], eax
and dword [ebp - 0x13c], 0
jmp 0x498f1e
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0x160]
jae 0x498f57
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x178]
call fcn.004115c9
mov ecx, eax
call fcn.00408b05
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdfOpenWithProgids
mov ecx, SysReAllocString
call fcn.0041b1df
pop ecx
jmp 0x498f11
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x178]
call fcn.00407b21
lea ecx, [ebp - 0x154]
call fcn.00407ae3
mov byte [ebp - 4], 9
lea eax, [ebp - 0x154]
push eax
mov edx, 0x4b46d0
mov ecx, SysReAllocString
call fcn.0041ad79
pop ecx
movzx eax, al
test eax, eax
je 0x499131
push 0x4b441c
push 0x4b4770
mov edx, SysReAllocString
lea ecx, [ebp - 0x28]
call fcn.0041ab36
pop ecx
pop ecx
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x154]
call fcn.004115e4
mov dword [ebp - 0x164], eax
and dword [ebp - 0x138], 0
jmp 0x498fdb
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x164]
jae 0x499125
push dword [ebp - 0x138]
lea ecx, [ebp - 0x154]
call fcn.004115c9
mov ecx, eax
call fcn.00408b05
push eax
push 0x4b4830
mov edx, SysReAllocString
lea ecx, [ebp - 0x118]
call fcn.0041ab36
pop ecx
pop ecx
mov dword [ebp - 0x168], eax
mov ecx, dword [ebp - 0x168]
call fcn.00408b05
push eax
push 0x4b442c
call fcn.00461e7e
pop ecx
pop ecx
test eax, eax
jne 0x49904b
mov dword [ebp - 0x144], 1
jmp 0x499052
and dword [ebp - 0x144], 0
mov al, byte [ebp - 0x144]
mov byte [ebp - 0x132], al
lea ecx, [ebp - 0x118]
call fcn.00408cf0
movzx eax, byte [ebp - 0x132]
test eax, eax
je 0x499120
push 0
push dword [ebp - 0x138]
lea ecx, [ebp - 0x154]
call fcn.004115c9
push eax
lea ecx, [ebp - 0x28]
call fcn.004116f2
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xffffffff
je 0x499120
push 1
push dword [ebp - 0x148]
lea ecx, [ebp - 0x28]
call fcn.00411768
lea ecx, [ebp - 0x28]
call fcn.00408b05
push eax
lea ecx, [ebp - 0xb8]
call fcn.00408923
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0xb8]
push eax
push str.MRUList
mov edx, 0x4b48e8
mov ecx, SysReAllocString
call fcn.0041afa7
pop ecx
pop ecx
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xb8]
call fcn.00408cf0
push dword [ebp - 0x138]
lea ecx, [ebp - 0x154]
call fcn.004115c9
mov ecx, eax
call fcn.00408b05
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdfOpenWithList
mov ecx, SysReAllocString
call fcn.0041b1df
pop ecx
jmp 0x498fce
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x28]
call fcn.00408cf0
push 0x4b4534
push 0x4b4a30
mov edx, SysReAllocString
lea ecx, [ebp - 0x40]
call fcn.0041ab36
pop ecx
pop ecx
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x40]
call fcn.00408b05
mov edx, 0x4b45dc
mov ecx, eax
call fcn.0041be20
test eax, eax
je 0x499175
mov edx, str.SoftwareClasseshttp
mov ecx, SysReAllocString
call fcn.0041b08c
push 0x4b476c
push 0x4b4a98
mov edx, SysReAllocString
lea ecx, [ebp - 0x130]
call fcn.0041ab36
pop ecx
pop ecx
mov dword [ebp - 0x16c], eax
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x40]
call fcn.004117ee
lea ecx, [ebp - 0x130]
call fcn.00408cf0
lea ecx, [ebp - 0x40]
call fcn.00408b05
mov edx, 0x4b480c
mov ecx, eax
call fcn.0041be20
test eax, eax
je 0x4991d7
mov edx, str.SoftwareClasseshttps
mov ecx, SysReAllocString
call fcn.0041b08c
push 0x4b48cc
mov edx, str.RegisteredApplications
mov ecx, SysReAllocString
call fcn.0041b1df
pop ecx
mov edx, 0x4b4b58
mov ecx, SysReAllocString
call fcn.0041b08c
mov edx, str.SoftwareClientsStartMenuInternetSogouExplorer.exeCapabilitiesFileAssociations
mov ecx, SysReAllocString
call fcn.0041b08c
mov edx, str.SOFTWAREClassesSogouExplorerHTML
mov ecx, SysReAllocString
call fcn.0041b08c
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsSogouExplorer.exe
mov ecx, SysReAllocString
call fcn.0041b08c
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x40]
call fcn.00408cf0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x154]
call fcn.00407b21
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x58]
call fcn.00408cf0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xd0]
call fcn.00408cf0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.00408cf0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045c170
leave
ret