Function at 0x41646e
Capabilities:
Create process on windows
Delete file

Disassembly:
push 0x284
mov eax, 0x46f2dc
call fcn.00452180
push dword [ebp + 0xc]
mov ebx, ecx
mov ecx, dword [0x4937e0]
mov eax, dword [ecx]
mov dword [ebp - 0x234], ebx
call dword [eax + 0xc]
push dword [ebp + 0xc]
lea eax, [ebp - 0x228]
push eax
call fcn.0041d6dc
mov eax, dword [0x4938e8]
pop ecx
pop ecx
lea edi, [ebp - 0x230]
lea esi, [ebp - 0x228]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x230], 0x4938e4
call fcn.00418031
test al, al
jne 0x41693a
cmp dword [ebp + 8], 0
mov edi, dword [ebp - 0x228]
jne 0x416780
test edi, edi
jne 0x4164eb
call fcn.0044d6f0
mov esi, dword [ebp - 0x224]
cmp esi, dword [edi + 4]
jne 0x4164fb
call fcn.0044d6f0
push dword [esi + 0xc]
call fcn.0041ccd9
test eax, eax
pop ecx
je 0x41675c
cmp esi, dword [edi + 4]
jne 0x416516
call fcn.0044d6f0
mov dword [esi + 0x3c], 2
cmp esi, dword [edi + 4]
jne 0x416527
call fcn.0044d6f0
push dword [esi + 0xc]
call fcn.0041d3bf
test eax, eax
pop ecx
jne 0x416693
xor edi, edi
inc edi
mov eax, edi
mov ecx, ebx
call fcn.0041543d
lea ecx, [ebx + 0x20]
mov eax, dword [ecx]
push edi
call dword [eax + 4]
lea eax, [ebp - 0x22c]
push str._r_n_r_nQQ
lea ecx, [ebx + 0xec]
push eax
mov dword [ebx + 0xe0], edi
call fcn.004039a1
pop ecx
pop ecx
and dword [ebp - 4], 0
push edi
push dword [ebp - 0x22c]
mov edi, ebx
call fcn.00416179
mov eax, dword [ebp - 0x228]
cmp esi, dword [eax + 4]
jne 0x41658e
call fcn.0044d6f0
xor eax, eax
mov dword [esi + 0x3c], 6
push 0x208
push eax
mov dword [0x49387c], eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
mov byte [0x49386c], 1
call fcn.0044a1a0
add esp, 0xc
push str.SOFTWARETencentQQPCMgr
lea edi, [ebp - 0x220]
mov ebx, str.InstallDir
call fcn.00409f66
mov dword [esp], str.QQPCClinic.exe
mov eax, edi
push 0x104
push eax
call fcn.0044eaa1
add esp, 0xc
push 0x40
xor esi, esi
lea eax, [ebp - 0x28c]
push esi
push eax
call fcn.0044a1a0
xor eax, eax
mov dword [ebp - 0x244], esi
lea edi, [ebp - 0x240]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x290]
push eax
push esi
push esi
push 0x2000000
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
push esi
mov dword [ebp - 0x290], 0x44
mov dword [ebp - 0x264], 1
mov word [ebp - 0x260], si
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, esi
je 0x41666b
push dword [ebp - 0x244]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x240]
call esi
mov eax, dword [ebp - 0x234]
call fcn.00415874
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x22c]
add eax, 0xfffffff0
call fcn.00401976
mov ebx, dword [ebp - 0x234]
jmp 0x416808
mov al, byte [0x490bcc]
test al, al
jne 0x4166f1
mov eax, dword [0x490bd0]
cmp eax, 1
mov byte [0x493874], 1
jne 0x4166e4
push 0x40041
push 0x481d78
push 0x481d88
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
je 0x4166fc
mov byte [0x49386c], 0x10
and dword [0x49387c], 0
mov eax, ebx
call fcn.00415874
jmp 0x41693a
test eax, eax
jne 0x4166fc
mov byte [0x49386c], 0x11
jmp 0x4166d1
cmp al, 1
jne 0x4166fc
mov byte [0x493874], 0
cmp esi, dword [edi + 4]
jne 0x416706
call fcn.0044d6f0
push dword [esi + 0xc]
call fcn.0041d518
test eax, eax
pop ecx
je 0x416808
cmp esi, dword [edi + 4]
jne 0x416721
call fcn.0044d6f0
push dword [esi + 0xc]
call fcn.0041d4a9
test eax, eax
pop ecx
je 0x416744
cmp esi, dword [edi + 4]
jne 0x416738
call fcn.0044d6f0
mov dword [esi + 0x3c], 4
jmp 0x416808
cmp esi, dword [edi + 4]
jne 0x41674e
call fcn.0044d6f0
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x416808
cmp esi, dword [edi + 4]
jne 0x416766
call fcn.0044d6f0
mov dword [esi + 0x3c], 7
and dword [0x49387c], 0
mov byte [0x49386c], 3
jmp 0x416808
test edi, edi
jne 0x416789
call fcn.0044d6f0
mov esi, dword [ebp - 0x224]
cmp esi, dword [edi + 4]
jne 0x416799
call fcn.0044d6f0
mov eax, dword [ebp + 8]
mov dword [esi + 0x3c], 7
mov byte [0x49386c], 3
mov dword [0x49387c], eax
cmp esi, dword [edi + 4]
jne 0x4167b9
call fcn.0044d6f0
lea eax, [ebp - 0x22c]
push eax
call fcn.0041d396
pop ecx
mov dword [ebp - 0x224], eax
mov dword [ebp - 4], 1
cmp esi, dword [edi + 4]
jne 0x4167dd
call fcn.0044d6f0
mov eax, dword [ebp - 0x224]
push dword [eax]
add esi, 0x40
push 0x481dd0
push esi
call fcn.00414622
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x22c]
add esp, 0xc
add eax, 0xfffffff0
call fcn.00401976
call fcn.0041d85d
test al, al
je 0x416828
mov ebx, dword [ebx + 0x34]
test ebx, ebx
je 0x41693a
mov eax, ebx
call fcn.00413eff
jmp 0x41693a
call fcn.0041d7e2
test al, al
je 0x4168b0
xor esi, esi
inc esi
cmp dword [0x4937f0], esi
jne 0x416850
mov byte [0x493888], 1
call fcn.004173d0
mov ebx, dword [ebp - 0x234]
jmp 0x4168a1
lea eax, [ebp - 0x22c]
push str._r_n_r_nQQ
mov byte [0x493888], 0
lea ecx, [ebx + 0xec]
push eax
mov dword [ebx + 0xe0], esi
call fcn.004039a1
pop ecx
pop ecx
push esi
mov dword [ebp - 4], 2
push dword [ebp - 0x22c]
mov edi, ebx
call fcn.00416179
mov ecx, dword [ebx + 0x34]
call fcn.004141af
mov eax, dword [ebp - 0x22c]
add eax, 0xfffffff0
call fcn.00401976
mov dword [ebx + 0xe4], 1
jmp 0x41693a
call fcn.0041d8d8
test al, al
je 0x416932
xor esi, esi
inc esi
cmp dword [0x4937f0], esi
jne 0x4168d8
mov byte [0x493888], 1
call fcn.004173d0
mov ebx, dword [ebp - 0x234]
jmp 0x416929
lea eax, [ebp - 0x224]
push str._r_n_r_nQQ
mov byte [0x493888], 0
lea ecx, [ebx + 0xec]
push eax
mov dword [ebx + 0xe0], esi
call fcn.004039a1
pop ecx
pop ecx
push esi
mov dword [ebp - 4], 3
push dword [ebp - 0x224]
mov edi, ebx
call fcn.00416179
mov ecx, dword [ebx + 0x34]
call fcn.00413ffe
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
call fcn.00401976
and dword [ebx + 0xe4], 0
jmp 0x41693a
mov ecx, dword [ebx + 4]
call fcn.0041c4e0
xor eax, eax
call fcn.00452203
ret 8