Function at 0x40bfb3
Capabilities:
Create process on windows
Create process suspended
Get common file path
Read file via mapping

Disassembly:
push 0x8f4
mov eax, 0x46c07b
call fcn.0043b363
push str.84R117E1_6649_4C8C_85A9_56CCE0CE3106_SEFreeUpgradeProcess
xor edi, edi
push edi
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x8a8], eax
cmp eax, 0xffffffff
je 0x40c0b3
test eax, eax
je 0x40c0b3
push 4
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x40c0a2
mov ebx, dword [eax]
push eax
mov dword [ebp - 0x8a4], ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 9
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
call esi
push 1
mov ebx, eax
call esi
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x430]
push eax
push dword [ebp - 0x8a4]
movups xmmword [ebp - 0x430], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp - 0x424]
mov eax, dword [ebp - 0x42c]
sub ecx, eax
sub eax, dword [ebp - 0x424]
mov esi, dword [ebp - 0x430]
add eax, edi
push 0x15
push ecx
mov ecx, dword [ebp - 0x428]
xor edi, edi
cdq
sub ecx, esi
sub esi, dword [ebp - 0x428]
sub eax, edx
sar eax, 1
push ecx
push eax
lea eax, [ebx + esi]
mov ebx, dword [ebp - 0x8a4]
cdq
sub eax, edx
sar eax, 1
push eax
push edi
push ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push edi
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [ebp - 0x8a8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40c3c9
push 7
pop ebx
xor eax, eax
mov dword [ebp - 0x434], ebx
mov esi, 0x489730
mov dword [ebp - 0x438], edi
push esi
mov word [ebp - 0x448], ax
call fcn.004402a6
pop ecx
push eax
push esi
lea ecx, [ebp - 0x448]
call fcn.0040299b
mov dword [ebp - 4], edi
xor eax, eax
push esi
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x450], edi
mov word [ebp - 0x460], ax
call fcn.004402a6
pop ecx
push eax
push esi
lea ecx, [ebp - 0x460]
call fcn.0040299b
mov byte [ebp - 4], 1
call fcn.0040bf01
test al, al
je 0x40c136
mov esi, 0x489734
push esi
call fcn.004402a6
pop ecx
push eax
push esi
lea ecx, [ebp - 0x448]
call fcn.0040299b
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.0043bad0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.0043d550
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
xor eax, eax
mov dword [ebp - 0x464], ebx
mov dword [ebp - 0x468], edi
mov word [ebp - 0x478], ax
cmp word [ebp - 0x218], ax
jne 0x40c195
mov eax, edi
jmp 0x40c1a2
lea eax, [ebp - 0x218]
push eax
call fcn.004402a6
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x478]
call fcn.0040299b
mov esi, 0x489738
mov byte [ebp - 4], 2
push esi
call fcn.004402a6
pop ecx
push eax
push esi
lea ecx, [ebp - 0x478]
call fcn.004023d6
xor eax, eax
mov dword [ebp - 0x47c], ebx
mov esi, str.3.0.0.0000
mov dword [ebp - 0x480], edi
push esi
mov word [ebp - 0x490], ax
call fcn.004402a6
pop ecx
push eax
push esi
lea ecx, [ebp - 0x490]
call fcn.0040299b
push 0x208
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.0043bad0
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.SogouGame
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.00442e3f
cmp dword [ebp - 0x44c], 8
lea eax, [ebp - 0x894]
mov dword [ebp - 0x8a0], edi
lea esi, [ebp - 0x448]
lea edi, [ebp - 0x460]
mov dword [ebp - 0x89c], 0x200
cmovae edi, dword [ebp - 0x460]
lea ecx, [ebp - 0x8a0]
cmp dword [ebp - 0x434], 8
mov edx, 0x48977c
mov dword [ebp - 0x898], eax
cmovae esi, dword [ebp - 0x448]
call fcn.0040b793
lea edx, [ebp - 0x478]
mov ecx, eax
call fcn.0040c460
mov edx, 0x489788
mov ecx, eax
call fcn.0040b793
lea edx, [ebp - 0x490]
mov ecx, eax
call fcn.0040c460
mov ebx, 0x489780
mov ecx, eax
mov edx, ebx
call fcn.0040b793
lea edx, [ebp - 0x420]
mov ecx, eax
call fcn.0040b793
mov edx, ebx
mov ecx, eax
call fcn.0040b793
mov edx, esi
mov ecx, eax
call fcn.0040b793
mov edx, ebx
mov ecx, eax
call fcn.0040b793
mov edx, edi
mov ecx, eax
call fcn.0040b793
mov edx, 0x48977c
mov ecx, eax
call fcn.0040b793
push 0x40
xor edi, edi
mov dword [ebp - 0x900], 0x44
lea eax, [ebp - 0x8fc]
push edi
push eax
call fcn.0043bad0
mov eax, dword [ebp - 0x8a0]
add esp, 0x18
mov ecx, dword [ebp - 0x898]
xorps xmm0, xmm0
xor edx, edx
movups xmmword [ebp - 0x8b8], xmm0
mov word [ecx + eax*2], dx
lea eax, [ebp - 0x8b8]
push eax
lea eax, [ebp - 0x900]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x898]
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40c377
push dword [ebp - 0x8b8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x8b4]
call esi
lea eax, [ebp - 0x894]
cmp dword [ebp - 0x898], eax
je 0x40c391
push dword [ebp - 0x898]
call fcn.00440047
pop ecx
push edi
push 1
lea ecx, [ebp - 0x490]
call fcn.00402f3e
push edi
push 1
lea ecx, [ebp - 0x478]
call fcn.00402f3e
push edi
push 1
lea ecx, [ebp - 0x460]
call fcn.00402f3e
push edi
push 1
lea ecx, [ebp - 0x448]
call fcn.00402f3e
call fcn.0043b30d
ret