Function at 0x441f33
Capabilities:
Accept command line arguments
Enumerate processes

Disassembly:
push 0x4a4
mov eax, 0x4b4680
call fcn.00461a91
mov esi, edx
mov edi, ecx
cmp byte [ebp + 8], 0
je 0x4425ce
cmp edi, 2
jge 0x442052
xor edi, edi
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x44204b
lea eax, [ebp - 0x2cc]
mov dword [ebp - 0x2cc], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x44203c
lea eax, [ebp - 0x2a8]
push str.SogouExplorerUp.exe
push eax
call fcn.00467153
pop ecx
pop ecx
test eax, eax
jne 0x44202e
push dword [ebp - 0x2c4]
mov ecx, 0x410
call fcn.0044b587
mov ebx, eax
test ebx, ebx
je 0x44202e
mov edx, ebx
lea ecx, [ebp - 0x28]
call fcn.00446713
mov ecx, ebx
mov dword [ebp - 4], edi
call fcn.0044b48f
lea eax, [ebp - 0x4b0]
mov dword [ebp - 0x4b0], edi
push eax
lea ecx, [ebp - 0x28]
call fcn.00404e0f
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x4b0], 2
mov ebx, eax
jne 0x44201b
push str._auto
push dword [ebx + 4]
call fcn.00467153
pop ecx
pop ecx
test eax, eax
jne 0x44201b
mov dword [0x4f7160], edi
mov dword [0x4f71d4], 4
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405118
lea eax, [ebp - 0x2cc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x441f8c
mov ecx, esi
call fcn.0044b48f
mov al, 1
jmp 0x4426b5
push 2
push 0x4d25fc
push dword [esi + 4]
call fcn.0046686b
xor ebx, ebx
add esp, 0xc
inc ebx
test eax, eax
jne 0x44209e
mov byte [0x4f717c], bl
cmp edi, 4
jl 0x4426b3
push 5
push str._path
push dword [esi + 8]
call fcn.0046686b
add esp, 0xc
test eax, eax
jne 0x4426b3
push dword [esi + 0xc]
mov ecx, 0x4f7164
jmp 0x4420f0
push 2
push 0x4d260c
push dword [esi + 4]
call fcn.0046686b
add esp, 0xc
test eax, eax
jne 0x4420bf
mov byte [0x4f717e], bl
jmp 0x4426b3
push 2
push 0x4d2604
push dword [esi + 4]
call fcn.0046686b
add esp, 0xc
test eax, eax
jne 0x4420fa
mov dword [0x4f7160], 5
cmp edi, 3
jne 0x4426b3
push dword [esi + 8]
mov ecx, 0x4f7240
call fcn.0040f8b1
jmp 0x4426b3
push 8
push str._Elevate
push dword [esi + 4]
call fcn.0046686b
add esp, 0xc
test eax, eax
jne 0x44217d
cmp edi, 4
jne 0x4426b3
push dword [esi + 8]
lea ecx, [ebp - 0x28]
call fcn.00404d2c
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x58]
push dword [esi + 0xc]
call fcn.00404d2c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00441eb5
lea eax, [ebp - 0x28]
mov dword [0x4f7160], 6
push eax
mov ecx, 0x4f71d8
mov byte [0x4f717c], bl
mov byte [0x4f717f], bl
call fcn.00405ca2
lea eax, [ebp - 0x58]
mov ecx, 0x4f71f0
push eax
call fcn.00405ca2
lea ecx, [ebp - 0x58]
call fcn.00405118
jmp 0x442381
push 0xd
push str._GetChangeLog
push dword [esi + 4]
call fcn.0046686b
add esp, 0xc
test eax, eax
jne 0x4421ea
push 3
pop ebx
cmp edi, ebx
jne 0x4421e3
lea ecx, [ebp - 0x4ac]
call fcn.0040a6f3
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x4ac]
push dword [esi + 8]
push str.SE_CHANGELOG_
push eax
call fcn.0040a68b
pop ecx
pop ecx
push eax
call fcn.0040a68b
pop ecx
pop ecx
lea ecx, [ebp - 0x4ac]
call fcn.0040a840
mov ecx, eax
call fcn.00441661
lea ecx, [ebp - 0x4ac]
call fcn.0040a6d0
xor al, al
jmp 0x4426b5
push 0xa
push str._GetImage2
push dword [esi + 4]
call fcn.0046686b
add esp, 0xc
test eax, eax
jne 0x4422a7
cmp edi, 3
jne 0x4421e3
push 0xe
push str._GetImage2_125
push dword [esi + 4]
call fcn.0046686b
add esp, 0xc
test eax, eax
jne 0x442223
push 6
jmp 0x44223b
push 0xe
push str._GetImage2_150
push dword [esi + 4]
call fcn.0046686b
add esp, 0xc
test eax, eax
jne 0x44223e
push 7
pop edi
jmp 0x44225c
push 0xe
push str._GetImage2_200
push dword [esi + 4]
call fcn.0046686b
add esp, 0xc
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffffd
add edi, 8
lea ecx, [ebp - 0x4ac]
call fcn.0040a6f3
mov dword [ebp - 4], 4
lea eax, [ebp - 0x4ac]
push dword [esi + 8]
push str.SE_CHANGELOG_IMAGE_
push eax
call fcn.0040a68b
pop ecx
pop ecx
push eax
call fcn.0040a68b
pop ecx
pop ecx
push edi
lea ecx, [ebp - 0x4ac]
call fcn.0040a840
mov dl, 1
mov ecx, eax
call fcn.00441716
pop ecx
jmp 0x4421d8
push 9
push str._GetImage
push dword [esi + 4]
call fcn.0046686b
add esp, 0xc
test eax, eax
jne 0x442307
cmp edi, 3
jne 0x4421e3
lea ecx, [ebp - 0x4ac]
call fcn.0040a6f3
mov dword [ebp - 4], 5
lea eax, [ebp - 0x4ac]
push dword [esi + 8]
push str.SE_CHANGELOG_IMAGE_
push eax
call fcn.0040a68b
pop ecx
pop ecx
push eax
call fcn.0040a68b
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x4ac]
call fcn.0040a840
xor dl, dl
jmp 0x44229a
push 8
push str._extract
push dword [esi + 4]
call fcn.0046686b
add esp, 0xc
test eax, eax
jne 0x44238e
cmp edi, 3
jne 0x4426b3
push dword [esi + 8]
lea ecx, [ebp - 0x28]
call fcn.00404d2c
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 6
call fcn.00441eb5
lea ecx, [ebp - 0x28]
call fcn.004417ed
test al, al
jne 0x442359
lea ecx, [ebp - 0x28]
call fcn.00405118
jmp 0x4421e3
lea eax, [ebp - 0x28]
mov dword [0x4f7160], ebx
push eax
mov ecx, 0x4f7228
call fcn.00405ca2
lea eax, [ebp - 0x28]
mov ecx, 0x4f7164
push eax
call fcn.00405ca2
mov byte [0x4f717c], bl
lea ecx, [ebp - 0x28]
call fcn.00405118
jmp 0x4426b3
push 9
push str._manually
push dword [esi + 4]
call fcn.0046686b
add esp, 0xc
test eax, eax
je 0x4425b8
push 9
push str.manually
push dword [esi + 4]
call fcn.0046686b
add esp, 0xc
test eax, eax
je 0x4425b8
push dword [esi + 4]
lea ecx, [ebp - 0x40]
call fcn.00404d2c
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 7
call fcn.00441eb5
lea ecx, [ebp - 0x40]
call fcn.004417ed
lea ecx, [ebp - 0x40]
test al, al
jne 0x442405
call fcn.00404e0f
push eax
push str.Upgrade_Not_valid__s
push 2
call fcn.00443e68
add esp, 0xc
jmp 0x4425b0
call fcn.00441b62
test al, al
je 0x44241a
mov dword [0x4f7160], 2
jmp 0x442440
lea eax, [ebp - 0x40]
mov dword [0x4f7160], 3
push eax
mov ecx, 0x4f7228
call fcn.00405ca2
lea eax, [ebp - 0x40]
mov ecx, 0x4f7164
push eax
call fcn.00405ca2
cmp edi, 2
jne 0x442457
mov dword [0x4f71d4], 4
lea ecx, [ebp - 0x40]
jmp 0x442384
jle 0x44244f
cmp edi, 3
jle 0x44247a
push 8
push str._norunse
push dword [esi + 0xc]
call fcn.0046686b
add esp, 0xc
neg eax
sbb al, al
and byte [0x4f09c0], al
push 6
push str._type0
push dword [esi + 8]
call fcn.0046686b
add esp, 0xc
test eax, eax
jne 0x442498
mov dword [0x4f71d4], ebx
jmp 0x44244f
push 6
push str._type1
push dword [esi + 8]
call fcn.0046686b
add esp, 0xc
test eax, eax
jne 0x44257d
cmp dword [0x4f7160], 3
mov dword [0x4f71d4], 2
mov byte [0x4f717c], bl
jne 0x44244f
cmp byte [0x4f09c0], al
je 0x442576
push 0x4cf78c
lea eax, [ebp - 0x58]
push 0x4f7164
push eax
call fcn.00403d38
push str.SogouExplorer.exe
push eax
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 8
push eax
call fcn.00403de8
add esp, 0x18
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xa
call fcn.00405118
push 0x4cf2f0
lea ecx, [ebp - 0x88]
call fcn.00404d2c
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0xb
call fcn.00404e0f
push eax
lea ecx, [ebp - 0x70]
call fcn.00404d2c
xor edi, edi
mov byte [ebp - 4], 0xc
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
lea edx, [ebp - 0x88]
lea ecx, [ebp - 0x70]
call fcn.00445fa9
add esp, 0x14
lea ecx, [ebp - 0x70]
call fcn.00405118
lea ecx, [ebp - 0x88]
call fcn.00405118
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 7
call fcn.00405118
push str._type1_small_upgrade_preExtract_not_valid
jmp 0x4425a7
push 6
push str._type2
push dword [esi + 8]
call fcn.0046686b
add esp, 0xc
test eax, eax
jne 0x4425a2
mov dword [0x4f71d4], 3
jmp 0x44244f
push str.unkown_CMD
push 2
call fcn.00443e68
pop ecx
pop ecx
lea ecx, [ebp - 0x40]
jmp 0x44234f
and dword [0x4f7160], 0
mov dword [0x4f71d4], 4
jmp 0x4426b3
xor ebx, ebx
xor ecx, ecx
inc ebx
mov dword [ebp - 0x4b0], ecx
cmp edi, 2
jl 0x442609
push 0x4d260c
push dword [esi + 4]
call fcn.00467153
pop ecx
pop ecx
test eax, eax
jne 0x442607
mov ecx, ebx
mov byte [0x4f717e], bl
mov byte [0x4f717f], bl
mov dword [ebp - 0x4b0], ecx
jmp 0x442609
xor ecx, ecx
lea eax, [ecx + 2]
cmp edi, eax
jl 0x44268a
push str._cover
push dword [esi + ecx*4 + 4]
call fcn.00467153
pop ecx
pop ecx
test eax, eax
jne 0x442636
mov byte [0x4f7180], bl
mov byte [0x4f717c], bl
mov byte [0x4f717f], bl
mov eax, dword [ebp - 0x4b0]
push str._backup
push dword [esi + eax*4 + 4]
call fcn.00467153
pop ecx
pop ecx
test eax, eax
jne 0x442662
mov byte [0x4f7181], bl
mov byte [0x4f717c], bl
mov byte [0x4f717f], bl
mov eax, dword [ebp - 0x4b0]
push 0x4d25fc
push dword [esi + eax*4 + 4]
call fcn.00467153
pop ecx
pop ecx
movzx ecx, byte [0x4f717c]
test eax, eax
cmove ecx, ebx
mov byte [0x4f717c], cl
cmp edi, 5
jl 0x4426b3
push 8
push str._SelfDel
push dword [esi + 4]
call fcn.0046686b
movzx ecx, byte [0x4f717d]
add esp, 0xc
test eax, eax
cmove ecx, ebx
mov byte [0x4f717d], cl
mov al, bl
call fcn.00461a3b
ret