Function at 0x409ab0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b4c1c
mov eax, dword fs:[0]
push eax
sub esp, 0xfb0
mov eax, dword [0x4f4930]
xor eax, esp
mov dword [esp + 0xfa8], eax
push ebx
push esi
push edi
mov eax, dword [0x4f4930]
xor eax, esp
push eax
lea eax, [esp + 0xfc0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x1f4
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x206
xor ebx, ebx
lea edx, [esp + 0x5b2]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x5b8], cx
call fcn.00476c30
add esp, 0xc
lea eax, [esp + 0x5ac]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x409d44
push 0x206
lea edx, [esp + 0x3aa]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x3b0], cx
call fcn.00476c30
add esp, 0xc
lea eax, [esp + 0x3a4]
push eax
push ebx
push str.sgbsugg
lea ecx, [esp + 0x5b8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x409d44
lea edx, [esp + 0x3a4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [esp + 0x20], bl
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x27c]
mov dword [esp + 0xfc8], ebx
call fcn.0041ead0
lea ecx, [esp + 0x154]
call fcn.0041ead0
lea ecx, [esp + 0x2c]
call fcn.0041ead0
lea eax, [esp + 0x154]
push eax
push ecx
mov byte [esp + 0xfd0], 3
call fcn.00401760
add esp, 4
lea ebx, [esp + 0x30]
lea edi, [esp + 0x280]
mov esi, eax
call fcn.0045a460
test al, al
jne 0x409bf9
lea ecx, [esp + 0x1c]
call fcn.0041a4d0
push 0x7fe
xor ebx, ebx
lea edx, [esp + 0x7ba]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x7c0], cx
call fcn.00476c30
add esp, 0xc
lea edx, [esp + 0x160]
cmp byte [esp + 0x270], bl
jne 0x409c32
mov edx, dword [esp + 0x15c]
lea ecx, [esp + 0x38]
cmp byte [esp + 0x148], bl
jne 0x409c43
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x288]
cmp byte [esp + 0x398], bl
jne 0x409c5a
mov eax, dword [esp + 0x284]
add edx, 4
push edx
add ecx, 4
push ecx
add eax, 4
push eax
push str.http:__config.pinyin.sogou.com_components_update.php_h_sv_sr_sutp3
lea eax, [esp + 0x7c4]
push 0x400
push eax
call fcn.0046fdbd
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x33]
push edx
lea eax, [esp + 0x3c4]
push eax
lea ecx, [esp + 0x7d8]
push ecx
lea ecx, [esp + 0x50]
mov edx, str.SogouComponentAgent
mov dword [esp + 0x50], ebx
mov byte [esp + 0x3f], bl
mov dword [esp + 0x4c], ebx
call fcn.0040da20
add esp, 0x28
test al, al
jne 0x409d78
mov esi, 0x4d4d70
mov dword [esp + 0x2c], esi
cmp byte [esp + 0x148], bl
jne 0x409ce3
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x38]
cmp eax, edx
je 0x409ce3
push eax
call fcn.00470027
add esp, 4
mov dword [esp + 0x154], esi
cmp byte [esp + 0x270], bl
jne 0x409d0e
mov eax, dword [esp + 0x15c]
lea ecx, [esp + 0x160]
cmp eax, ecx
je 0x409d0e
push eax
call fcn.00470027
add esp, 4
mov dword [esp + 0x27c], esi
cmp byte [esp + 0x398], bl
jne 0x409d39
mov eax, dword [esp + 0x284]
lea edx, [esp + 0x288]
cmp eax, edx
je 0x409d39
push eax
call fcn.00470027
add esp, 4
lea ecx, [esp + 0x1c]
call fcn.0041a420
xor ebx, ebx
mov eax, dword [esp + 0x18]
mov dword [eax + 0xb0], 3
mov eax, dword [0x4fb764]
cmp eax, ebx
je 0x409e5b
mov ecx, dword [eax + 0x124]
push ebx
push ebx
push 0x8001
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x409e5b
mov esi, dword [esp + 0x18]
push 1
push esi
lea ecx, [esp + 0x3ac]
mov byte [esi + 0xac], bl
call fcn.004094d0
mov ecx, esi
call fcn.00407340
mov eax, dword [0x4fb764]
mov dword [esi + 0xb0], 2
cmp eax, ebx
je 0x409dc7
movzx edx, byte [esi + 0xac]
mov eax, dword [eax + 0x124]
push edx
push 1
push 0x8001
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [esp + 0x3a4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, 0x4d4d70
mov dword [esp + 0x2c], esi
cmp byte [esp + 0x148], bl
jne 0x409dfc
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x38]
cmp eax, edx
je 0x409dfc
push eax
call fcn.00470027
add esp, 4
mov dword [esp + 0x154], esi
cmp byte [esp + 0x270], bl
jne 0x409e27
mov eax, dword [esp + 0x15c]
lea ecx, [esp + 0x160]
cmp eax, ecx
je 0x409e27
push eax
call fcn.00470027
add esp, 4
mov dword [esp + 0x27c], esi
cmp byte [esp + 0x398], bl
jne 0x409e52
mov eax, dword [esp + 0x284]
lea edx, [esp + 0x288]
cmp eax, edx
je 0x409e52
push eax
call fcn.00470027
add esp, 4
lea ecx, [esp + 0x1c]
call fcn.0041a420
mov ecx, dword [esp + 0xfc0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xfa8]
xor ecx, esp
call fcn.0046fdae
mov esp, ebp
pop ebp
ret 4