Function at 0x402d60
Capabilities:
Accept command line arguments
Check if file exists
Create process on windows
Move file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4122a9
mov eax, dword fs:[0]
push eax
sub esp, 0x500
mov eax, dword [0x41b068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4ec], eax
call fcn.00402aa0
push 0x208
lea eax, [ebp - 0x44c]
push 0
push eax
call fcn.004068e0
push 0x208
lea eax, [ebp - 0x244]
push 0
push eax
call fcn.004068e0
add esp, 0x18
lea eax, [ebp - 0x244]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
lea eax, [ebp - 0x244]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCanonicalizeW]
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov dword [ebp - 0x46c], 0
xor eax, eax
mov dword [ebp - 0x45c], 0
lea ecx, [ebp - 0x44c]
mov dword [ebp - 0x458], 7
mov word [ebp - 0x46c], ax
lea edx, [ecx + 2]
mov dword [ebp - 4], 0xffffffff
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402e50
sub ecx, edx
lea eax, [ebp - 0x44c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x46c]
call fcn.00404d30
mov dword [ebp - 4], 1
mov dword [ebp - 0x49c], 0
xor eax, eax
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x488], 7
mov word [ebp - 0x49c], ax
mov edi, 0x7ffffffe
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x45c]
mov eax, edi
sub eax, ecx
cmp eax, 5
jb 0x4039f5
cmp dword [ebp - 0x458], 8
lea eax, [ebp - 0x46c]
push 5
cmovae eax, dword [ebp - 0x46c]
push str.Work_
push ecx
push eax
push ecx
push dword [ebp - 0x4ec]
lea ecx, [ebp - 0x4e4]
call fcn.00404740
push str.QQGame.exe
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 4], 4
call fcn.00403e60
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x470], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x484], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x474], xmm0
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x4d0]
cmp ecx, 8
jb 0x402f8b
mov edx, dword [ebp - 0x4e4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x402f81
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4039fa
push ecx
push edx
call fcn.00405a11
add esp, 8
xor eax, eax
mov dword [ebp - 0x4d4], 0
cmp dword [ebp - 0x470], 8
mov word [ebp - 0x4e4], ax
lea eax, [ebp - 0x484]
cmovae eax, dword [ebp - 0x484]
push eax
mov dword [ebp - 0x4d0], 7
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403028
mov ecx, dword [ebp - 0x45c]
mov eax, edi
sub eax, ecx
cmp eax, 5
jb 0x4039ff
cmp dword [ebp - 0x458], 8
lea eax, [ebp - 0x46c]
push 5
cmovae eax, dword [ebp - 0x46c]
push str.Work_
push ecx
push eax
push ecx
push dword [ebp - 0x4ec]
lea ecx, [ebp - 0x4b4]
call fcn.00404740
lea eax, [ebp - 0x4b4]
push eax
lea ecx, [ebp - 0x49c]
call fcn.00403f10
lea ecx, [ebp - 0x4b4]
call fcn.004016b0
jmp 0x40304b
cmp dword [ebp - 0x470], 8
lea eax, [ebp - 0x484]
mov dword [ebp - 0x474], 0
cmovae eax, dword [ebp - 0x484]
xor ecx, ecx
mov word [eax], cx
xor esi, esi
mov dword [ebp - 0x4f0], esi
cmp dword [ebp - 0x474], esi
jne 0x40368e
lea esi, [ebp - 0x12]
mov ecx, 0xe3cf
nop word [eax + eax]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x403070
mov dword [ebp - 0x508], edx
mov word [ebp - 0x508], dx
mov eax, 7
lea edx, [ebp - 0x12]
mov dword [ebp - 0x50c], ecx
mov dword [ebp - 0x4f8], ecx
mov dword [ebp - 0x4f4], eax
mov byte [ebp - 4], 8
cmp esi, edx
je 0x4030e4
mov eax, edx
lea ecx, [ebp - 0x508]
sub eax, esi
sar eax, 1
push eax
push esi
call fcn.00404d30
mov ecx, dword [ebp - 0x4f8]
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x50c], ecx
sub eax, ecx
mov byte [ebp - 4], 0xa
cmp eax, 5
jb 0x4031a1
cmp dword [ebp - 0x4f4], 8
lea edx, [ebp - 0x508]
lea eax, [ecx + 5]
cmovae edx, dword [ebp - 0x508]
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 0x450], edx
cmp edx, 0x4183b6
jae 0x403140
lea eax, [edx + ecx*2]
cmp eax, str.Hall.
jb 0x403140
cmp edx, str.Hall.
ja 0x403134
xor edi, edi
jmp 0x403145
mov edi, edx
sub edi, str.Hall.
sar edi, 1
jmp 0x403145
mov edi, 5
mov eax, dword [ebp - 0x50c]
lea ecx, [edx + 0xa]
lea eax, [eax*2 + 2]
push eax
push edx
push ecx
call fcn.00406360
lea esi, [edi + edi]
push esi
push str.Hall.
push dword [ebp - 0x450]
call fcn.00406360
mov ecx, dword [ebp - 0x450]
lea edx, [edi*2 + 0x4183b6]
mov eax, 5
add ecx, esi
sub eax, edi
add eax, eax
push eax
push edx
push ecx
call fcn.00406360
add esp, 0x24
lea eax, [ebp - 0x508]
mov edi, 0x7ffffffe
jmp 0x4031b9
push 5
sub esp, 8
lea ecx, [ebp - 0x508]
push dword [ebp - 0x4ec]
push 5
call fcn.00404400
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x4b4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x4a4], xmm0
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x4f4]
cmp ecx, 8
jb 0x403227
mov edx, dword [ebp - 0x508]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40321d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403a04
push ecx
push edx
call fcn.00405a11
add esp, 8
mov ecx, dword [ebp - 0x45c]
xor eax, eax
mov word [ebp - 0x508], ax
mov eax, edi
sub eax, ecx
mov dword [ebp - 0x4f8], 0
mov dword [ebp - 0x4f4], 7
cmp eax, 5
jb 0x403a09
cmp dword [ebp - 0x458], 8
lea eax, [ebp - 0x46c]
push 5
cmovae eax, dword [ebp - 0x46c]
push str.Hall_
push ecx
push eax
push ecx
push dword [ebp - 0x4ec]
lea ecx, [ebp - 0x4cc]
call fcn.00404740
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x4cc]
cmp dword [ebp - 0x4b8], 8
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x4cc]
push eax
call esi
test eax, eax
je 0x40344e
mov edx, dword [ebp - 0x45c]
mov eax, edi
mov esi, dword [ebp - 0x4a4]
sub eax, edx
cmp eax, esi
jb 0x403a0e
cmp dword [ebp - 0x458], 8
lea ecx, [ebp - 0x46c]
push esi
cmovae ecx, dword [ebp - 0x46c]
lea eax, [ebp - 0x4b4]
cmp dword [ebp - 0x4a0], 8
cmovae eax, dword [ebp - 0x4b4]
push eax
push edx
push ecx
push ecx
push dword [ebp - 0x4ec]
lea ecx, [ebp - 0x508]
call fcn.00404740
push 0x418270
lea edx, [ebp - 0x508]
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x2c]
call fcn.004040f0
add esp, 4
lea ecx, [ebp - 0x49c]
push eax
call fcn.00403f10
lea ecx, [ebp - 0x2c]
call fcn.004016b0
lea ecx, [ebp - 0x508]
mov byte [ebp - 4], 0xf
call fcn.004016b0
cmp dword [ebp - 0x488], 8
lea eax, [ebp - 0x49c]
cmovae eax, dword [ebp - 0x49c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4034b2
mov edi, dword [ebp + 8]
lea esi, [eax + 1]
mov byte [ebp - 0x4e5], 1
cmp edi, esi
jle 0x4033a8
nop word [eax + eax]
mov eax, dword [ebp - 0x4ec]
push str.__no_shortcut
push dword [eax + esi*4]
call fcn.004087a2
add esp, 8
test eax, eax
je 0x4033a1
inc esi
cmp esi, edi
jl 0x403380
jmp 0x4033a8
mov byte [ebp - 0x4e5], 0
cmp dword [ebp - 0x488], 8
lea ecx, [ebp - 0x49c]
push 8
cmovae ecx, dword [ebp - 0x49c]
lea eax, [ebp - 0x4cc]
cmp dword [ebp - 0x4b8], 8
push ecx
cmovae eax, dword [ebp - 0x4cc]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4033ee
mov esi, 1
mov dword [ebp - 0x4f0], esi
jmp 0x403552
mov dl, byte [ebp - 0x4e5]
lea ecx, [ebp - 0x49c]
call fcn.00401e10
test al, al
jne 0x403550
push 0x40000
push 0x4183c4
push 0x4183d0
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40343e
push 1
push 0
push 0x4181e4
push str.https:__qqgame.qq.com_download.shtml
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, 2
mov dword [ebp - 0x4f0], esi
jmp 0x403552
push 0x208
lea eax, [ebp - 0x244]
push 0
push eax
call fcn.004068e0
add esp, 0xc
lea eax, [ebp - 0x244]
push 0
push eax
push str.TempestHallDirectory
push str.SoftwareTENCENTQQGameSYS
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHRegGetPathW]
test eax, eax
jne 0x4034b9
lea eax, [ebp - 0x244]
push eax
call esi
test eax, eax
je 0x4034b9
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x49c]
call fcn.00403ee0
xor esi, esi
jmp 0x403557
mov edx, dword [ebp - 0x45c]
mov eax, edi
mov esi, dword [ebp - 0x4a4]
sub eax, edx
cmp eax, esi
jb 0x403a13
cmp dword [ebp - 0x458], 8
lea ecx, [ebp - 0x46c]
push esi
cmovae ecx, dword [ebp - 0x46c]
lea eax, [ebp - 0x4b4]
cmp dword [ebp - 0x4a0], 8
cmovae eax, dword [ebp - 0x4b4]
push eax
push edx
push ecx
push ecx
push dword [ebp - 0x4ec]
lea ecx, [ebp - 0x508]
call fcn.00404740
push 0x418270
lea edx, [ebp - 0x508]
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x2c]
call fcn.004040f0
add esp, 4
lea ecx, [ebp - 0x49c]
push eax
call fcn.00403f10
lea ecx, [ebp - 0x2c]
call fcn.004016b0
lea ecx, [ebp - 0x508]
mov byte [ebp - 4], 0xf
call fcn.004016b0
xor esi, esi
jmp 0x403557
xor esi, esi
mov edi, 0x7ffffffe
mov ecx, dword [ebp - 0x48c]
sub edi, ecx
cmp edi, 0xa
jb 0x403a18
cmp dword [ebp - 0x488], 8
lea eax, [ebp - 0x49c]
push 0xa
cmovae eax, dword [ebp - 0x49c]
push str.QQGame.exe
push ecx
push eax
push ecx
push dword [ebp - 0x4ec]
lea ecx, [ebp - 0x508]
call fcn.00404740
lea eax, [ebp - 0x508]
push eax
lea ecx, [ebp - 0x484]
call fcn.00403f10
mov ecx, dword [ebp - 0x4f4]
cmp ecx, 8
jb 0x4035e9
mov edx, dword [ebp - 0x508]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4035df
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403a1d
push ecx
push edx
call fcn.00405a11
add esp, 8
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x4b8]
cmp ecx, 8
jb 0x40362d
mov edx, dword [ebp - 0x4cc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403623
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403a1d
push ecx
push edx
call fcn.00405a11
add esp, 8
xor eax, eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x4a0]
mov dword [ebp - 0x4bc], 0
mov dword [ebp - 0x4b8], 7
mov word [ebp - 0x4cc], ax
cmp ecx, 8
jb 0x40368e
mov edx, dword [ebp - 0x4b4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403684
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403a1d
push ecx
push edx
call fcn.00405a11
add esp, 8
call fcn.004024b0
test esi, esi
jne 0x4038e2
cmp dword [ebp - 0x470], 8
lea eax, [ebp - 0x484]
cmovae eax, dword [ebp - 0x484]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4036f9
push 0x40004
push 0x4183c4
push 0x418460
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x4036ee
push 1
push esi
push 0x4181e4
push str.https:__qqgame.qq.com_download.shtml
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, 3
mov dword [ebp - 0x4f0], esi
call fcn.00401b80
test al, al
jne 0x4038e2
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetArgsW]
cmp dword [ebp - 0x470], 8
lea edi, [ebp - 0x484]
mov dword [ebp - 0x4ec], eax
jb 0x403736
mov edi, dword [ebp - 0x484]
test edi, edi
je 0x4037f6
cmp word [edi], 0
je 0x4037f6
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x403745
sub esi, ecx
mov edx, 2
sar esi, 1
xor ecx, ecx
add esi, 0x104
xorps xmm0, xmm0
mov eax, esi
movlpd qword [ebp - 0x454], xmm0
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00405a54
add esp, 4
lea ecx, [ebp - 0x454]
push eax
call fcn.00404060
push edi
mov byte [ebp - 4], 0x12
push esi
mov esi, dword [ebp - 0x454]
push esi
call fcn.00409225
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x40382e
push esi
lea ecx, [ebp - 0x4e4]
call fcn.00403fc0
cmp dword [ebp - 0x4d0], 8
lea eax, [ebp - 0x4e4]
push 0
cmovae eax, dword [ebp - 0x4e4]
push esi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea ecx, [ebp - 0x4e4]
call fcn.004016b0
jmp 0x40382e
xorps xmm0, xmm0
push 0x208
movlpd qword [ebp - 0x454], xmm0
call fcn.00405a54
add esp, 4
lea ecx, [ebp - 0x454]
push eax
call fcn.00404060
mov esi, dword [ebp - 0x454]
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
call eax
mov edi, dword [ebp - 0x450]
mov dword [ebp - 0x450], edi
mov dword [ebp - 0x454], esi
push dword [ebp - 0x4ec]
lea ecx, [ebp - 0x4b4]
mov byte [ebp - 4], 0x13
call fcn.00403fc0
lea eax, [ebp - 0x4b4]
mov byte [ebp - 4], 0x14
push eax
lea eax, [ebp - 0x484]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401c90
cmp dword [eax + 0x14], 8
jb 0x40387f
mov eax, dword [eax]
push ecx
mov edx, esi
mov ecx, eax
call fcn.00401d80
add esp, 4
lea ecx, [ebp - 0x2c]
test eax, eax
sete byte [ebp - 0x4e5]
call fcn.004016b0
lea ecx, [ebp - 0x4b4]
call fcn.004016b0
test edi, edi
je 0x4038cd
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x4038cd
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], esi
dec esi
jne 0x4038cd
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
cmp byte [ebp - 0x4e5], 0
mov eax, 4
mov esi, dword [ebp - 0x4f0]
cmovne esi, eax
mov ecx, dword [ebp - 0x470]
cmp ecx, 8
jb 0x403922
mov edx, dword [ebp - 0x484]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403918
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403a22
push ecx
push edx
call fcn.00405a11
add esp, 8
mov ecx, dword [ebp - 0x488]
xor eax, eax
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x470], 7
mov word [ebp - 0x484], ax
cmp ecx, 8
jb 0x40397f
mov edx, dword [ebp - 0x49c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403975
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403a22
push ecx
push edx
call fcn.00405a11
add esp, 8
mov ecx, dword [ebp - 0x458]
xor eax, eax
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x488], 7
mov word [ebp - 0x49c], ax
cmp ecx, 8
jb 0x4039d8
mov edx, dword [ebp - 0x46c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4039ce
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403a22
push ecx
push edx
call fcn.00405a11
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004059e0
mov esp, ebp
pop ebp
ret
call fcn.00404c00
call fcn.00408a5f
call fcn.00404c00
call fcn.00408a5f
call fcn.00404c00
call fcn.00404c00
call fcn.00404c00
call fcn.00404c00
call fcn.00408a5f
call fcn.00408a5f
int3