Function at 0x436850
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c8f8a
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
push esi
push edi
push ecx
lea edi, [ebp - 0xe8]
mov ecx, 0x37
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x4f3280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x1c]
call fcn.0041dc10
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x170
call fcn.004636c0
push eax
lea ecx, [ebp - 0x40]
call fcn.00431e70
mov byte [ebp - 4], 1
lea edi, [ebp - 0x40]
call fcn.0048be70
lea ecx, [ebp - 0x40]
call fcn.0048bd10
push eax
lea ecx, [ebp - 0x4c]
call fcn.00402fc0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x4c]
push eax
push 0x4dd678
lea ecx, [ebp - 0xb4]
push ecx
call fcn.0043aef0
add esp, 0xc
mov dword [ebp - 0xdc], eax
mov edx, dword [ebp - 0xdc]
mov dword [ebp - 0xe0], edx
mov byte [ebp - 4], 3
push str.QQPCTray.exe___regrun
mov eax, dword [ebp - 0xe0]
push eax
lea ecx, [ebp - 0x58]
push ecx
call fcn.0043adf0
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb4]
call fcn.00403050
mov ecx, dword [ebp - 0x14]
add ecx, 0x170
call fcn.004636c0
push eax
lea ecx, [ebp - 0x7c]
call fcn.00431e70
mov byte [ebp - 4], 6
lea edx, [ebp - 0x7c]
push edx
lea ecx, [ebp - 0xd0]
call fcn.0048b5f0
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xe8], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0xe8]
push ecx
lea ecx, [ebp - 0x7c]
call fcn.00431ea0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xd0]
call fcn.004069c0
lea ecx, [ebp - 0x7c]
call fcn.0048bd10
push eax
lea ecx, [ebp - 0x88]
call fcn.00402fc0
mov byte [ebp - 4], 8
cmp dword [0x4f8304], 0
jne 0x436a46
push 0
push 0x4dd67c
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.00406a20
test eax, eax
je 0x436a13
lea edi, [ebp - 0x40]
call fcn.0048bed0
lea ecx, [ebp - 0x40]
call fcn.0048bd10
push eax
lea ecx, [ebp - 0x4c]
call fcn.00403080
lea ecx, [ebp - 0x4c]
call fcn.004636c0
push eax
push 0x4dd6b0
lea ecx, [ebp - 0x1c]
call fcn.00432160
lea ecx, [ebp - 0x88]
call fcn.004636c0
push eax
push 0x4dd6c8
lea ecx, [ebp - 0x1c]
call fcn.00432160
push 0
push 0x4dd6d8
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.00406a20
test eax, eax
je 0x436a41
lea ecx, [ebp - 0x58]
call fcn.004636c0
push eax
push 0x4dd734
lea ecx, [ebp - 0x1c]
call fcn.00432160
jmp 0x436b27
lea ecx, [ebp - 0x94]
call fcn.0041dc10
mov byte [ebp - 4], 9
push 0
push 0x4dd748
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.00432c10
test eax, eax
je 0x436ace
mov ecx, dword [ebp - 0x14]
add ecx, 0x170
call fcn.004636c0
push eax
push 0x4dd77c
lea ecx, [ebp - 0x94]
call fcn.00432cf0
lea ecx, [ebp - 0x88]
call fcn.004636c0
push eax
push 0x4dd794
lea ecx, [ebp - 0x94]
call fcn.00432cf0
mov edx, dword [ebp - 0x88]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x170]
push ecx
push str.InstallDir:_s_Version:_s
mov esi, 0x4f8948
call fcn.0048a930
add esp, 0xc
push 0
push 0x4dd7d8
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.00432c10
test eax, eax
je 0x436b18
lea ecx, [ebp - 0x58]
call fcn.004636c0
push eax
push 0x4dd834
lea ecx, [ebp - 0x94]
call fcn.00432cf0
mov edx, dword [ebp - 0x58]
push edx
push 0x4dd848
mov esi, 0x4f8948
call fcn.0048a930
add esp, 8
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x94]
call fcn.00432b80
call fcn.004013e0
lea ecx, [ebp - 0xa0]
call fcn.00417ee0
mov byte [ebp - 4], 0xa
push 0
push 0x4dd858
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.00406a20
test eax, eax
je 0x436c4a
lea eax, [ebp - 0xa0]
push eax
push 0x4dd88c
lea ecx, [ebp - 0x1c]
call fcn.00432020
lea ecx, [ebp - 0xa0]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.00436de0
mov edx, dword [ebp - 0x14]
add edx, 0x170
push edx
lea ecx, [ebp - 0xac]
call fcn.004180a0
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00436de0
lea ecx, [ebp - 0xa0]
call fcn.004636c0
push eax
lea ecx, [ebp - 0xac]
call fcn.0041ec00
test eax, eax
jne 0x436c3b
mov dword [ebp - 0xd4], 1
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xac]
call fcn.00403050
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa0]
call fcn.00403050
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x88]
call fcn.00403050
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x7c]
call fcn.004069c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.00403050
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.00403050
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004069c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004069f0
mov eax, dword [ebp - 0xd4]
jmp 0x436cb7
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xac]
call fcn.00403050
mov dword [ebp - 0xd8], 0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa0]
call fcn.00403050
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x88]
call fcn.00403050
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x7c]
call fcn.004069c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.00403050
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.00403050
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004069c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004069f0
mov eax, dword [ebp - 0xd8]
push edx
mov ecx, ebp
push eax
lea edx, [0x436cf0]
call fcn.004c39f9
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1723
add esp, 0xe8
cmp ebp, esp
call fcn.004c39d6
mov esp, ebp
pop ebp
ret