Function at 0x4424e8
Capabilities:
Accept command line arguments
Enumerate processes

Disassembly:
push 0x4a4
mov eax, 0x4a1560
call fcn.0045cd4f
mov esi, edx
mov edi, ecx
cmp byte [ebp + 8], 0
je 0x442b83
cmp edi, 2
jge 0x442607
xor edi, edi
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x442600
lea eax, [ebp - 0x2cc]
mov dword [ebp - 0x2cc], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x4425f1
lea eax, [ebp - 0x2a8]
push str.SogouExplorerUp.exe
push eax
call fcn.00461e7e
pop ecx
pop ecx
test eax, eax
jne 0x4425e3
push dword [ebp - 0x2c4]
mov ecx, 0x410
call fcn.0044325e
mov ebx, eax
test ebx, ebx
je 0x4425e3
mov edx, ebx
lea ecx, [ebp - 0x28]
call fcn.00440a6e
mov ecx, ebx
mov dword [ebp - 4], edi
call fcn.00443166
lea eax, [ebp - 0x4b0]
mov dword [ebp - 0x4b0], edi
push eax
lea ecx, [ebp - 0x28]
call fcn.00408b05
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x4b0], 2
mov ebx, eax
jne 0x4425d0
push str._auto
push dword [ebx + 4]
call fcn.00461e7e
pop ecx
pop ecx
test eax, eax
jne 0x4425d0
mov dword [0x4e1b90], edi
mov dword [0x4e1c04], 4
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00408cf0
lea eax, [ebp - 0x2cc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x442541
mov ecx, esi
call fcn.00443166
mov al, 1
jmp 0x442c6a
push 2
push 0x4bc37c
push dword [esi + 4]
call fcn.004650f0
xor ebx, ebx
add esp, 0xc
inc ebx
test eax, eax
jne 0x442653
mov byte [0x4e1bac], bl
cmp edi, 4
jl 0x442c68
push 5
push str._path
push dword [esi + 8]
call fcn.004650f0
add esp, 0xc
test eax, eax
jne 0x442c68
push dword [esi + 0xc]
mov ecx, 0x4e1b94
jmp 0x4426a5
push 2
push 0x4bc390
push dword [esi + 4]
call fcn.004650f0
add esp, 0xc
test eax, eax
jne 0x442674
mov byte [0x4e1bae], bl
jmp 0x442c68
push 2
push 0x4bc398
push dword [esi + 4]
call fcn.004650f0
add esp, 0xc
test eax, eax
jne 0x4426af
mov dword [0x4e1b90], 5
cmp edi, 3
jne 0x442c68
push dword [esi + 8]
mov ecx, 0x4e1c70
call fcn.0040848d
jmp 0x442c68
push 8
push str._Elevate
push dword [esi + 4]
call fcn.004650f0
add esp, 0xc
test eax, eax
jne 0x442732
cmp edi, 4
jne 0x442c68
push dword [esi + 8]
lea ecx, [ebp - 0x28]
call fcn.00408923
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x58]
push dword [esi + 0xc]
call fcn.00408923
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00442454
lea eax, [ebp - 0x28]
mov dword [0x4e1b90], 6
push eax
mov ecx, 0x4e1c08
mov byte [0x4e1bac], bl
mov byte [0x4e1baf], bl
call fcn.00409086
lea eax, [ebp - 0x58]
mov ecx, 0x4e1c20
push eax
call fcn.00409086
lea ecx, [ebp - 0x58]
call fcn.00408cf0
jmp 0x442936
push 0xd
push str._GetChangeLog
push dword [esi + 4]
call fcn.004650f0
add esp, 0xc
test eax, eax
jne 0x44279f
push 3
pop ebx
cmp edi, ebx
jne 0x442798
lea ecx, [ebp - 0x4ac]
call fcn.00410936
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x4ac]
push dword [esi + 8]
push str.SE_CHANGELOG_
push eax
call fcn.004108ce
pop ecx
pop ecx
push eax
call fcn.004108ce
pop ecx
pop ecx
lea ecx, [ebp - 0x4ac]
call fcn.00410b38
mov ecx, eax
call fcn.00441b79
lea ecx, [ebp - 0x4ac]
call fcn.00410913
xor al, al
jmp 0x442c6a
push 0xa
push str._GetImage2
push dword [esi + 4]
call fcn.004650f0
add esp, 0xc
test eax, eax
jne 0x44285c
cmp edi, 3
jne 0x442798
push 0xe
push str._GetImage2_125
push dword [esi + 4]
call fcn.004650f0
add esp, 0xc
test eax, eax
jne 0x4427d8
push 6
jmp 0x4427f0
push 0xe
push str._GetImage2_150
push dword [esi + 4]
call fcn.004650f0
add esp, 0xc
test eax, eax
jne 0x4427f3
push 7
pop edi
jmp 0x442811
push 0xe
push str._GetImage2_200
push dword [esi + 4]
call fcn.004650f0
add esp, 0xc
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffffd
add edi, 8
lea ecx, [ebp - 0x4ac]
call fcn.00410936
mov dword [ebp - 4], 4
lea eax, [ebp - 0x4ac]
push dword [esi + 8]
push str.SE_CHANGELOG_IMAGE_
push eax
call fcn.004108ce
pop ecx
pop ecx
push eax
call fcn.004108ce
pop ecx
pop ecx
push edi
lea ecx, [ebp - 0x4ac]
call fcn.00410b38
mov dl, 1
mov ecx, eax
call fcn.00441c2e
pop ecx
jmp 0x44278d
push 9
push str._GetImage
push dword [esi + 4]
call fcn.004650f0
add esp, 0xc
test eax, eax
jne 0x4428bc
cmp edi, 3
jne 0x442798
lea ecx, [ebp - 0x4ac]
call fcn.00410936
mov dword [ebp - 4], 5
lea eax, [ebp - 0x4ac]
push dword [esi + 8]
push str.SE_CHANGELOG_IMAGE_
push eax
call fcn.004108ce
pop ecx
pop ecx
push eax
call fcn.004108ce
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x4ac]
call fcn.00410b38
xor dl, dl
jmp 0x44284f
push 8
push str._extract
push dword [esi + 4]
call fcn.004650f0
add esp, 0xc
test eax, eax
jne 0x442943
cmp edi, 3
jne 0x442c68
push dword [esi + 8]
lea ecx, [ebp - 0x28]
call fcn.00408923
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 6
call fcn.00442454
lea ecx, [ebp - 0x28]
call fcn.00441d05
test al, al
jne 0x44290e
lea ecx, [ebp - 0x28]
call fcn.00408cf0
jmp 0x442798
lea eax, [ebp - 0x28]
mov dword [0x4e1b90], ebx
push eax
mov ecx, 0x4e1c58
call fcn.00409086
lea eax, [ebp - 0x28]
mov ecx, 0x4e1b94
push eax
call fcn.00409086
mov byte [0x4e1bac], bl
lea ecx, [ebp - 0x28]
call fcn.00408cf0
jmp 0x442c68
push 9
push str._manually
push dword [esi + 4]
call fcn.004650f0
add esp, 0xc
test eax, eax
je 0x442b6d
push 9
push str.manually
push dword [esi + 4]
call fcn.004650f0
add esp, 0xc
test eax, eax
je 0x442b6d
push dword [esi + 4]
lea ecx, [ebp - 0x40]
call fcn.00408923
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 7
call fcn.00442454
lea ecx, [ebp - 0x40]
call fcn.00441d05
lea ecx, [ebp - 0x40]
test al, al
jne 0x4429ba
call fcn.00408b05
push eax
push str.Upgrade_Not_valid__s
push 2
call fcn.00443f03
add esp, 0xc
jmp 0x442b65
call fcn.00442077
test al, al
je 0x4429cf
mov dword [0x4e1b90], 2
jmp 0x4429f5
lea eax, [ebp - 0x40]
mov dword [0x4e1b90], 3
push eax
mov ecx, 0x4e1c58
call fcn.00409086
lea eax, [ebp - 0x40]
mov ecx, 0x4e1b94
push eax
call fcn.00409086
cmp edi, 2
jne 0x442a0c
mov dword [0x4e1c04], 4
lea ecx, [ebp - 0x40]
jmp 0x442939
jle 0x442a04
cmp edi, 3
jle 0x442a2f
push 8
push str._norunse
push dword [esi + 0xc]
call fcn.004650f0
add esp, 0xc
neg eax
sbb al, al
and byte [0x4d8af8], al
push 6
push str._type0
push dword [esi + 8]
call fcn.004650f0
add esp, 0xc
test eax, eax
jne 0x442a4d
mov dword [0x4e1c04], ebx
jmp 0x442a04
push 6
push str._type1
push dword [esi + 8]
call fcn.004650f0
add esp, 0xc
test eax, eax
jne 0x442b32
cmp dword [0x4e1b90], 3
mov dword [0x4e1c04], 2
mov byte [0x4e1bac], bl
jne 0x442a04
cmp byte [0x4d8af8], al
je 0x442b2b
push 0x4b894c
lea eax, [ebp - 0x58]
push 0x4e1b94
push eax
call fcn.004098b4
push str.SogouExplorer.exe
push eax
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 8
push eax
call fcn.00412622
add esp, 0x18
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xa
call fcn.00408cf0
push 0x4b82bc
lea ecx, [ebp - 0x88]
call fcn.00408923
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0xb
call fcn.00408b05
push eax
lea ecx, [ebp - 0x70]
call fcn.00408923
xor edi, edi
mov byte [ebp - 4], 0xc
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
lea edx, [ebp - 0x88]
lea ecx, [ebp - 0x70]
call fcn.0044004c
add esp, 0x14
lea ecx, [ebp - 0x70]
call fcn.00408cf0
lea ecx, [ebp - 0x88]
call fcn.00408cf0
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 7
call fcn.00408cf0
push str._type1_small_upgrade_preExtract_not_valid
jmp 0x442b5c
push 6
push str._type2
push dword [esi + 8]
call fcn.004650f0
add esp, 0xc
test eax, eax
jne 0x442b57
mov dword [0x4e1c04], 3
jmp 0x442a04
push str.unkown_CMD
push 2
call fcn.00443f03
pop ecx
pop ecx
lea ecx, [ebp - 0x40]
jmp 0x442904
and dword [0x4e1b90], 0
mov dword [0x4e1c04], 4
jmp 0x442c68
xor ebx, ebx
xor ecx, ecx
inc ebx
mov dword [ebp - 0x4b0], ecx
cmp edi, 2
jl 0x442bbe
push 0x4bc390
push dword [esi + 4]
call fcn.00461e7e
pop ecx
pop ecx
test eax, eax
jne 0x442bbc
mov ecx, ebx
mov byte [0x4e1bae], bl
mov byte [0x4e1baf], bl
mov dword [ebp - 0x4b0], ecx
jmp 0x442bbe
xor ecx, ecx
lea eax, [ecx + 2]
cmp edi, eax
jl 0x442c3f
push str._cover
push dword [esi + ecx*4 + 4]
call fcn.00461e7e
pop ecx
pop ecx
test eax, eax
jne 0x442beb
mov byte [0x4e1bb0], bl
mov byte [0x4e1bac], bl
mov byte [0x4e1baf], bl
mov eax, dword [ebp - 0x4b0]
push str._backup
push dword [esi + eax*4 + 4]
call fcn.00461e7e
pop ecx
pop ecx
test eax, eax
jne 0x442c17
mov byte [0x4e1bb1], bl
mov byte [0x4e1bac], bl
mov byte [0x4e1baf], bl
mov eax, dword [ebp - 0x4b0]
push 0x4bc37c
push dword [esi + eax*4 + 4]
call fcn.00461e7e
pop ecx
pop ecx
movzx ecx, byte [0x4e1bac]
test eax, eax
cmove ecx, ebx
mov byte [0x4e1bac], cl
cmp edi, 5
jl 0x442c68
push 8
push str._SelfDel
push dword [esi + 4]
call fcn.004650f0
movzx ecx, byte [0x4e1bad]
add esp, 0xc
test eax, eax
cmove ecx, ebx
mov byte [0x4e1bad], cl
mov al, bl
call fcn.0045ccf9
ret