Function at 0x436eb0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c8fba
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
push esi
push edi
push ecx
lea edi, [ebp - 0xe8]
mov ecx, 0x37
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x4f3280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x1c]
call fcn.0042dcc0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x170
call fcn.0042cd20
push eax
lea ecx, [ebp - 0x40]
call fcn.004093c0
mov byte [ebp - 4], 1
lea edi, [ebp - 0x40]
call fcn.0048c000
lea ecx, [ebp - 0x40]
call fcn.0048bea0
push eax
lea ecx, [ebp - 0x4c]
call fcn.00402f90
mov byte [ebp - 4], 2
lea eax, [ebp - 0x4c]
push eax
push 0x4dd678
lea ecx, [ebp - 0xb4]
push ecx
call fcn.0043b550
add esp, 0xc
mov dword [ebp - 0xdc], eax
mov edx, dword [ebp - 0xdc]
mov dword [ebp - 0xe0], edx
mov byte [ebp - 4], 3
push str.QQPCTray.exe___regrun
mov eax, dword [ebp - 0xe0]
push eax
lea ecx, [ebp - 0x58]
push ecx
call fcn.0043b450
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb4]
call fcn.00418010
mov ecx, dword [ebp - 0x14]
add ecx, 0x170
call fcn.0042cd20
push eax
lea ecx, [ebp - 0x7c]
call fcn.004093c0
mov byte [ebp - 4], 6
lea edx, [ebp - 0x7c]
push edx
lea ecx, [ebp - 0xd0]
call fcn.0048b780
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xe8], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0xe8]
push ecx
lea ecx, [ebp - 0x7c]
call fcn.00432420
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xd0]
call fcn.00406930
lea ecx, [ebp - 0x7c]
call fcn.0048bea0
push eax
lea ecx, [ebp - 0x88]
call fcn.00402f90
mov byte [ebp - 4], 8
cmp dword [0x4f8304], 0
jne 0x4370a6
push 0
push 0x4dd67c
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.00406990
test eax, eax
je 0x437073
lea edi, [ebp - 0x40]
call fcn.0048c060
lea ecx, [ebp - 0x40]
call fcn.0048bea0
push eax
lea ecx, [ebp - 0x4c]
call fcn.00403020
lea ecx, [ebp - 0x4c]
call fcn.0042cd20
push eax
push 0x4dd6b0
lea ecx, [ebp - 0x1c]
call fcn.00432790
lea ecx, [ebp - 0x88]
call fcn.0042cd20
push eax
push 0x4dd6c8
lea ecx, [ebp - 0x1c]
call fcn.00432790
push 0
push 0x4dd6d8
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.00406990
test eax, eax
je 0x4370a1
lea ecx, [ebp - 0x58]
call fcn.0042cd20
push eax
push 0x4dd734
lea ecx, [ebp - 0x1c]
call fcn.00432790
jmp 0x437187
lea ecx, [ebp - 0x94]
call fcn.0042dcc0
mov byte [ebp - 4], 9
push 0
push 0x4dd748
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.00433260
test eax, eax
je 0x43712e
mov ecx, dword [ebp - 0x14]
add ecx, 0x170
call fcn.0042cd20
push eax
push 0x4dd77c
lea ecx, [ebp - 0x94]
call fcn.00433340
lea ecx, [ebp - 0x88]
call fcn.0042cd20
push eax
push 0x4dd794
lea ecx, [ebp - 0x94]
call fcn.00433340
mov edx, dword [ebp - 0x88]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x170]
push ecx
push str.InstallDir:_s_Version:_s
mov esi, 0x4f8948
call fcn.0048aa50
add esp, 0xc
push 0
push 0x4dd7d8
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.00433260
test eax, eax
je 0x437178
lea ecx, [ebp - 0x58]
call fcn.0042cd20
push eax
push 0x4dd834
lea ecx, [ebp - 0x94]
call fcn.00433340
mov edx, dword [ebp - 0x58]
push edx
push 0x4dd848
mov esi, 0x4f8948
call fcn.0048aa50
add esp, 8
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x94]
call fcn.004331d0
call fcn.004013c0
lea ecx, [ebp - 0xa0]
call fcn.00418110
mov byte [ebp - 4], 0xa
push 0
push 0x4dd858
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.00406990
test eax, eax
je 0x4372aa
lea eax, [ebp - 0xa0]
push eax
push 0x4dd88c
lea ecx, [ebp - 0x1c]
call fcn.004325a0
lea ecx, [ebp - 0xa0]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.00437440
mov edx, dword [ebp - 0x14]
add edx, 0x170
push edx
lea ecx, [ebp - 0xac]
call fcn.00418140
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00437440
lea ecx, [ebp - 0xa0]
call fcn.0042cd20
push eax
lea ecx, [ebp - 0xac]
call fcn.0041f030
test eax, eax
jne 0x43729b
mov dword [ebp - 0xd4], 1
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xac]
call fcn.00418010
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa0]
call fcn.00418010
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x88]
call fcn.00418010
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x7c]
call fcn.00406930
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.00418010
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.00418010
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00406930
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00406960
mov eax, dword [ebp - 0xd4]
jmp 0x437317
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xac]
call fcn.00418010
mov dword [ebp - 0xd8], 0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa0]
call fcn.00418010
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x88]
call fcn.00418010
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x7c]
call fcn.00406930
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.00418010
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.00418010
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00406930
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00406960
mov eax, dword [ebp - 0xd8]
push edx
mov ecx, ebp
push eax
lea edx, [0x437350]
call fcn.004c3b59
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1873
add esp, 0xe8
cmp ebp, esp
call fcn.004c3b36
mov esp, ebp
pop ebp
ret