Function at 0x4110e0
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ec5e9
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x53e01c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x7e0], 0
jne 0x4115f6
cmp byte [edi + 0x7fa], 0
mov eax, dword [edi + 0x69c]
mov byte [edi + 0x7e0], 1
je 0x4114e8
cmp eax, 0xa
jne 0x4111e2
xor ebx, ebx
call fcn.00411620
test al, al
jne 0x411169
push dword [0x541044]
push dword [edi + 0x678]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push ebx
push dword [edi + 0x28c]
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x411175
xor ebx, ebx
cmp dword [edi + 0x7f0], ebx
setne bl
inc ebx
cmp dword [edi + 0x818], 8
lea esi, [edi + 0x804]
jb 0x411186
mov esi, dword [esi]
mov eax, dword [0x5552f8]
test al, 1
jne 0x4111b7
or eax, 1
mov dword [0x5552f8], eax
mov dword [ebp - 4], 0
call fcn.00442480
push 0x4f1ff0
call fcn.0045b82b
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x555468]
test ecx, ecx
je 0x4115ef
mov eax, dword [ecx]
push 0
push 0
push esi
push ebx
push dword [edi + 0x6a0]
push 1
push 0x7dc
call dword [eax + 4]
jmp 0x4115ef
cmp eax, 5
jne 0x411290
xor ebx, ebx
call fcn.00411620
test al, al
jne 0x411217
push dword [0x541044]
push dword [edi + 0x678]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push ebx
push dword [edi + 0x28c]
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x411223
xor ebx, ebx
cmp dword [edi + 0x7f0], ebx
setne bl
inc ebx
cmp dword [edi + 0x818], 8
lea esi, [edi + 0x804]
jb 0x411234
mov esi, dword [esi]
mov eax, dword [0x5552f8]
test al, 1
jne 0x411265
or eax, 1
mov dword [0x5552f8], eax
mov dword [ebp - 4], 1
call fcn.00442480
push 0x4f1ff0
call fcn.0045b82b
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x555468]
test ecx, ecx
je 0x4115ef
mov eax, dword [ecx]
push 0
push 0
push esi
push ebx
push dword [edi + 0x6a0]
push 2
push 0x7dc
call dword [eax + 4]
jmp 0x4115ef
cmp eax, 7
je 0x4113e5
cmp eax, 8
je 0x4113e5
cmp eax, 9
jne 0x4115ef
cmp dword [edi + 0x818], 8
lea esi, [edi + 0x804]
jb 0x4112bc
mov esi, dword [esi]
mov eax, dword [0x5552f8]
test al, 1
jne 0x4112ed
or eax, 1
mov dword [0x5552f8], eax
mov dword [ebp - 4], 3
call fcn.00442480
push 0x4f1ff0
call fcn.0045b82b
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x555468]
test ecx, ecx
je 0x411316
movzx eax, byte [edi + 0x7fb]
mov edx, dword [ecx]
push 0
push 0
push esi
push eax
push dword [edi + 0x6a0]
push 5
push 0x7dc
call dword [edx + 4]
cmp byte [edi + 0x7fb], 0
je 0x4113d9
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor esi, esi
push 0x11
push str.SogouExplorer.exe
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
call fcn.00407890
lea ecx, [ebp - 0x28]
call fcn.0042a660
mov edx, dword [ebp - 0x14]
test eax, eax
sete bl
cmp edx, 8
jb 0x41139b
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411391
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411612
push edx
push ecx
call fcn.0045b5e1
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test bl, bl
jne 0x4113d4
push eax
push str.taskkill__F__IM_SogouExplorer.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 4
jl 0x411330
call fcn.00416430
mov ecx, edi
call fcn.00414890
jmp 0x4115ef
mov esi, dword [edi + 0x690]
test esi, esi
je 0x41144e
mov ecx, dword [esi + 0x60]
test ecx, ecx
je 0x41144e
mov ebx, dword [esi + 0x5c]
mov eax, ecx
neg eax
mov byte [esi + 0x69], 1
mov edx, eax
shr edx, 0x1f
mov dword [ebp - 0x2c], edx
mov byte [esi + 0x68], dl
cdq
xor eax, edx
sub eax, edx
cdq
idiv ebx
mov dword [esi + 0x64], eax
test edx, edx
je 0x41141f
inc eax
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x58]
mov edx, ebx
neg edx
cmp byte [ebp - 0x2c], 0
cmove edx, ebx
add edx, ecx
mov dword [esi + 0x60], edx
cmp edx, eax
jg 0x41143f
cmp edx, dword [esi + 0x54]
mov eax, edx
cmovl eax, dword [esi + 0x54]
mov dword [esi + 0x60], eax
mov ecx, esi
mov eax, dword [esi]
push 0
call dword [eax + 0x24]
dec dword [esi + 0x64]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 0x678]
call esi
push 5
push dword [edi + 0x67c]
call esi
push 0
push 6
push 0x7e9
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [edi + 0x818], 8
lea esi, [edi + 0x804]
jb 0x41148b
mov esi, dword [esi]
mov eax, dword [0x5552f8]
test al, 1
jne 0x4114bc
or eax, 1
mov dword [0x5552f8], eax
mov dword [ebp - 4], 2
call fcn.00442480
push 0x4f1ff0
call fcn.0045b82b
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x555468]
test ecx, ecx
je 0x4115ef
mov eax, dword [ecx]
push 0
push 0
push esi
push 0
push dword [edi + 0x6a0]
push 4
push 0x7dc
call dword [eax + 4]
jmp 0x4115ef
cmp eax, 3
jne 0x41151a
cmp dword [edi + 0x6a0], eax
jne 0x4115ea
push 0
call fcn.00414690
mov eax, dword [0x5552f8]
test al, 1
jne 0x411550
or eax, 1
mov dword [0x5552f8], eax
mov dword [ebp - 4], 4
jmp 0x411537
cmp eax, 5
jne 0x411571
mov eax, dword [0x5552f8]
test al, 1
jne 0x411550
or eax, 1
mov dword [0x5552f8], eax
mov dword [ebp - 4], 5
call fcn.00442480
push 0x4f1ff0
call fcn.0045b82b
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 1
mov ecx, 0x555300
call fcn.00446510
push 4
mov ecx, edi
call fcn.00412160
mov dword [edi + 0x7ec], 0
jmp 0x4115ef
cmp eax, 7
je 0x41157b
cmp eax, 8
jne 0x4115ef
mov esi, dword [edi + 0x690]
test esi, esi
je 0x4115e8
mov ecx, dword [esi + 0x60]
cmp ecx, 0x32
je 0x4115e8
mov ebx, dword [esi + 0x5c]
mov eax, 0x32
sub eax, ecx
mov byte [esi + 0x69], 1
mov edx, eax
shr edx, 0x1f
mov dword [ebp - 0x2c], edx
mov byte [esi + 0x68], dl
cdq
xor eax, edx
sub eax, edx
cdq
idiv ebx
mov dword [esi + 0x64], eax
test edx, edx
je 0x4115b9
inc eax
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x58]
mov edx, ebx
neg edx
cmp byte [ebp - 0x2c], 0
cmove edx, ebx
add edx, ecx
mov dword [esi + 0x60], edx
cmp edx, eax
jg 0x4115d9
cmp edx, dword [esi + 0x54]
mov eax, edx
cmovl eax, dword [esi + 0x54]
mov dword [esi + 0x60], eax
mov ecx, esi
mov eax, dword [esi]
push 0
call dword [eax + 0x24]
dec dword [esi + 0x64]
mov ecx, edi
call fcn.004143c0
mov byte [edi + 0x7e0], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045b5b0
mov esp, ebp
pop ebp
ret
call fcn.004c1e0f
int3