Function at 0x4155e3
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0xd4
mov eax, 0x476d44
call fcn.0044cfd2
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xe0], ecx
cmp eax, esi
je 0x415846
xor ecx, ecx
cmp cx, word [eax]
je 0x415846
push 7
pop edi
xor eax, eax
push 0x495620
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xa8], esi
mov word [ebp - 0xb8], ax
call fcn.004032fb
mov dword [ebp - 4], esi
xor eax, eax
push str.SoftwareWOW6432NodeSogouExplorer
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x8c], esi
mov word [ebp - 0x9c], ax
call fcn.004032fb
push 0x40340e
push 0x403043
push 4
xor ebx, ebx
push 0x1c
lea eax, [ebp - 0x80]
inc ebx
push eax
mov byte [ebp - 4], bl
call fcn.00451eed
mov byte [ebp - 4], 2
cmp dword [ebp - 0xa4], 8
mov eax, dword [ebp - 0xb8]
jae 0x41569c
lea eax, [ebp - 0xb8]
push esi
push eax
mov edi, SysReAllocString
lea eax, [ebp - 0xd4]
push edi
push eax
call fcn.00403b07
add esp, 0x10
push eax
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 3
call fcn.00403385
push esi
push ebx
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 2
call fcn.00403656
cmp dword [ebp - 0x88], 8
mov eax, dword [ebp - 0x9c]
jae 0x4156e6
lea eax, [ebp - 0x9c]
push esi
push eax
lea eax, [ebp - 0xd4]
push edi
push eax
call fcn.00403b07
add esp, 0x10
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 4
call fcn.00403385
push esi
push ebx
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 2
call fcn.00403656
cmp dword [ebp - 0xa4], 8
mov eax, dword [ebp - 0xb8]
jae 0x41572b
lea eax, [ebp - 0xb8]
push esi
push eax
mov edi, reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0xd4]
push edi
push eax
call fcn.00403b07
add esp, 0x10
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 5
call fcn.00403385
push esi
push ebx
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 2
call fcn.00403656
cmp dword [ebp - 0x88], 8
mov eax, dword [ebp - 0x9c]
jae 0x415775
lea eax, [ebp - 0x9c]
push esi
push eax
lea eax, [ebp - 0xd4]
push edi
push eax
call fcn.00403b07
add esp, 0x10
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.00403385
push esi
push ebx
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 2
call fcn.00403656
mov dword [ebp - 0xd8], esi
lea edi, [ebp - 0x80]
cmp dword [edi + 0x10], esi
je 0x415805
push str.SogouExplorer.exe
mov ecx, edi
call fcn.00402dbb
cmp dword [edi + 0x14], 8
jb 0x4157c9
mov eax, dword [edi]
jmp 0x4157cb
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415805
cmp dword [edi + 0x14], 8
mov eax, dword [ebp - 0xe0]
mov byte [eax], bl
jb 0x4157e8
mov eax, dword [edi]
jmp 0x4157ea
mov eax, edi
push 5
push esi
push dword [ebp - 0xdc]
push eax
push 0x495898
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x41584e
inc dword [ebp - 0xd8]
add edi, 0x1c
cmp dword [ebp - 0xd8], 4
jl 0x4157ae
push 0x40340e
push 4
push 0x1c
lea eax, [ebp - 0x80]
push eax
mov byte [ebp - 4], bl
call fcn.00451fc2
push esi
push ebx
lea ecx, [ebp - 0x9c]
call fcn.00403656
push esi
push ebx
lea ecx, [ebp - 0xb8]
call fcn.00403656
xor al, al
call fcn.0044d055
ret
push 0x40340e
push 4
push 0x1c
lea eax, [ebp - 0x80]
push eax
mov byte [ebp - 4], bl
call fcn.00451fc2
push esi
push ebx
lea ecx, [ebp - 0x9c]
call fcn.00403656
push esi
push ebx
lea ecx, [ebp - 0xb8]
call fcn.00403656
mov al, bl
jmp 0x415848