Function at 0x401790
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4283fa
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1c34
call fcn.004159e0
mov eax, dword [0x430080]
xor eax, esp
mov dword [esp + 0x1c30], eax
push ebx
push esi
push edi
mov eax, dword [0x430080]
xor eax, esp
push eax
lea eax, [esp + 0x1c48]
mov dword fs:[0], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x36]
push ecx
mov word [esp + 0x38], ax
call fcn.0040edd0
mov edx, dword [0x4312c8]
add esp, 0xc
mov dword [esp + 0x18], edx
push 0x104
lea eax, [esp + 0x30]
push eax
push str.PROGRAMFILES
mov dword [esp + 0x1c5c], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push str.SogouDownLoadDownLoadDlg.exe
lea ecx, [esp + 0x30]
push ecx
push str._s_s
mov edx, ecx
push 0x104
push edx
call fcn.0040e98b
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 0x14
push 0
call edi
push str._ExternalAppInstall
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push str._ExternalAppInstall
mov ebx, eax
lea esi, [esp + 0x1c]
call fcn.00401440
test byte [ebp + 8], 2
je 0x401bdf
xor eax, eax
push 0x7fe
push eax
lea ecx, [esp + 0x446]
push ecx
mov word [esp + 0x448], ax
call fcn.0040edd0
add esp, 0xc
push 0
call edi
test eax, eax
je 0x401898
mov ecx, dword [eax + 0x3c]
mov ecx, dword [ecx + eax + 0x58]
jmp 0x40189a
xor ecx, ecx
push ecx
push str.http:__yz.app.sogou.com_appinfo_num_d
lea edx, [esp + 0x444]
push 0x400
push edx
call fcn.0040e98b
mov eax, dword [0x4312c8]
add esp, 0x10
mov dword [esp + 0x14], eax
push 0
push 0x3e8
lea ecx, [esp + 0x1c]
push ecx
push ecx
mov byte [esp + 0x1c60], 1
lea ebx, [esp + 0x44c]
mov esi, esp
mov dword [esp + 0x20], esp
call fcn.00401050
call fcn.00404970
add esp, 0x10
test eax, eax
jne 0x401924
mov eax, dword [esp + 0x14]
lea edx, [eax - 0xc]
cmp edx, 0x4312b8
je 0x401bdf
lea esi, [eax - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x401bdf
push esi
call fcn.0040eabb
add esp, 4
jmp 0x401bdf
mov esi, dword [esp + 0x14]
mov eax, dword [esi - 8]
test eax, eax
jle 0x401bd6
js 0x401bd6
push str.statustrue
push esi
call fcn.0040ea5b
add esp, 8
test eax, eax
je 0x401bd6
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x401bd6
call fcn.00402f30
test eax, eax
je 0x401b82
cmp eax, 0x200001a
jae 0x401b82
lea esi, [esp + 0x1c]
call fcn.00401e30
mov eax, esi
push eax
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x1c58], 4
call fcn.00403450
xor edx, edx
push 0x7fe
push edx
lea eax, [esp + 0x144e]
push eax
mov word [esp + 0x1450], dx
call fcn.0040edd0
add esp, 0x14
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0xc46]
push edx
mov word [esp + 0xc48], cx
call fcn.0040edd0
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x23e]
push ecx
mov word [esp + 0x240], ax
call fcn.0040edd0
add esp, 0xc
mov ebx, str.softurl
lea esi, [esp + 0x10]
call fcn.00401050
mov edx, esi
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0x1c54], 5
call fcn.00401ea0
mov eax, dword [eax]
lea ecx, [esp + 0x143c]
push 0x400
push ecx
mov ecx, eax
call fcn.00403240
add esp, 8
test eax, eax
sete bl
mov byte [esp + 0x1c50], 4
call fcn.00401370
test bl, bl
je 0x401a5a
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x1c54], 1
call fcn.00401c60
jmp 0x401bd6
mov ebx, str.iconurl
lea esi, [esp + 0x10]
call fcn.00401050
mov eax, esi
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1c54], 6
call fcn.00401ea0
mov eax, dword [eax]
lea ecx, [esp + 0xc3c]
push 0x400
push ecx
mov ecx, eax
call fcn.00403240
add esp, 8
test eax, eax
sete bl
mov byte [esp + 0x1c50], 4
call fcn.00401370
test bl, bl
je 0x401ac2
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x1c54], 1
call fcn.00401c60
jmp 0x401bd6
mov ebx, str.softname
lea esi, [esp + 0x10]
call fcn.00401050
mov eax, esi
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1c54], 7
call fcn.00401ea0
mov eax, dword [eax]
lea ecx, [esp + 0x234]
push 0x104
push ecx
mov ecx, eax
call fcn.00403240
add esp, 8
test eax, eax
sete bl
mov byte [esp + 0x1c50], 4
call fcn.00401370
test bl, bl
je 0x401b2a
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x1c54], 1
call fcn.00401c60
jmp 0x401bd6
lea eax, [esp + 0x234]
push eax
lea ecx, [esp + 0xc40]
push ecx
lea edx, [esp + 0x1444]
push edx
push eax
push str._DownLoad_windowsname_sulr_sicourl_ssoftname_send
push 0x800
lea ecx, [esp + 0x30]
push ecx
mov eax, 0x800
call fcn.004012c0
push eax
call fcn.0040e98b
add esp, 0x1c
lea eax, [esp + 0x18]
call fcn.00401350
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x1c54], 1
call fcn.00401c60
jmp 0x401bd6
test byte [ebp + 8], 1
je 0x401ba6
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, str._Install_
call fcn.004015d0
mov byte [esp + 0x1c50], 2
jmp 0x401bc2
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
mov ecx, str._DownLoad_
call fcn.004015d0
mov byte [esp + 0x1c50], 3
mov edi, eax
lea eax, [esp + 0x18]
call fcn.004010b0
lea esi, [esp + 0x10]
call fcn.00401370
lea esi, [esp + 0x14]
call fcn.00401370
mov esi, dword [esp + 0x18]
push 1
push 0
push esi
lea ecx, [esp + 0x38]
push ecx
push 0x42c2b8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jge 0x401c0d
push eax
push str.Execute_Dlg_fail__error_Num___d
call fcn.004046e0
add esp, 8
lea edx, [esi - 0xc]
cmp edx, 0x4312b8
je 0x401c2f
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x401c2f
push esi
call fcn.0040eabb
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x1c48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c30]
xor ecx, esp
call fcn.0040e806
mov esp, ebp
pop ebp
ret