Function at 0x432f00
Capabilities:
Enumerate processes
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x4d406c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_FindWindowW]
push esi
push edi
push 0
push str.SE_SogouExplorerFrame
call ebx
mov esi, eax
test esi, esi
je 0x433193
xor eax, eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x248], eax
lea eax, [ebp - 0x248]
push eax
push str.SoftwareSogouExplorerTabSnapshot_repairetool
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
mov eax, dword [ebp - 0x248]
je 0x432f62
test eax, eax
je 0x432f96
mov ecx, eax
mov dword [ebp - 0x240], ecx
test ecx, ecx
je 0x432f96
push 0
push eax
push str.SoftwareSogouExplorerTabSnapshot
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHCopyKeyW]
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x240], eax
xor edi, edi
test esi, esi
je 0x432fc2
push 0
push 0
push 0x12
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.SE_SogouExplorerFrame
call ebx
inc edi
mov esi, eax
cmp edi, 3
jl 0x432f98
push 0x22c
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.0045f220
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 3
add esp, 0xc
mov dword [ebp - 0x23c], esi
nop dword [eax]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x238], 0x22c
lea eax, [ebp - 0x238]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x433070
nop dword [eax + eax]
lea eax, [ebp - 0x214]
push str.sogouexplorer.exe
push eax
call fcn.00465c67
add esp, 8
test eax, eax
jne 0x433058
push dword [ebp - 0x230]
push eax
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
lea eax, [ebp - 0x238]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x433020
mov esi, dword [ebp - 0x23c]
push edi
call ebx
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esi, 1
mov dword [ebp - 0x23c], esi
jne 0x432ff0
mov edx, str.SoftwareSogouExplorerTabSnapshot
call fcn.0044b85f
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea eax, [ebp - 0x23c]
push eax
push str.SoftwareSogouExplorerTabSnapshot
push 0x80000001
mov dword [ebp - 0x23c], 0
call edi
test eax, eax
mov eax, dword [ebp - 0x23c]
je 0x4330c5
test eax, eax
je 0x4330c9
mov ebx, eax
jmp 0x4330cf
mov ebx, dword [ebp - 0x240]
test ebx, ebx
je 0x4330f1
push 0
push ebx
push str.SoftwareSogouExplorerTabSnapshot_repairetool
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHCopyKeyW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call esi
jmp 0x4330f7
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x244]
mov dword [ebp - 0x248], 2
push eax
push 2
push 0
push str.SoftwareSogouExplorerTabSnapshot
push 0x80000001
mov dword [ebp - 0x244], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x43315e
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0
push eax
push str.SoftwareSogouExplorerTabSnapshot
push 0x80000001
call edi
test eax, eax
mov eax, dword [ebp - 0x23c]
je 0x433156
test eax, eax
je 0x43315e
mov dword [ebp - 0x244], eax
jmp 0x433164
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x433189
push 4
lea ecx, [ebp - 0x248]
push ecx
push 4
push 0
push str.Status
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x244]
call esi
mov edx, str.SoftwareSogouExplorerTabSnapshot_repairetool
call fcn.0044b85f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045cf38
mov esp, ebp
pop ebp
ret