Function at 0x4509d0
Capabilities:
Check if file exists
Copy file
Delete registry value
Persist via run registry key
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6e88
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str..qbox
push SysReAllocString
mov dword [ebp - 0x2c], 0
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov eax, dword [ebp - 0x2c]
jne 0x450a58
test eax, eax
je 0x450a5a
push 0x1a
push str.QQPCMgr.qbox
push 1
push 0
push 0x4ed230
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x450a65
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.QQPCMgr.qbox
push SysReAllocString
call esi
test eax, eax
mov eax, dword [ebp - 0x2c]
jne 0x450aac
test eax, eax
je 0x450ab3
push 0x1e
push 0x4f2b38
push 1
push 0
push 0x4ed230
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x450ab3
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.QQPCMgr.qboxDefaultIcon
push SysReAllocString
call esi
test eax, eax
jne 0x450b4a
mov edx, dword [ebp - 0x3c]
lea ecx, [ebp - 0x34]
push str.imageqbox.ico_0
lea edx, [edx + 4]
call fcn.0041c010
add esp, 4
mov esi, dword [eax]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x450b29
mov edx, esi
lea ecx, [edx + 2]
mov dword [ebp - 0x38], ecx
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x450b04
sub edx, dword [ebp - 0x38]
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push esi
push 1
push 0
push 0x4ed230
push eax
call ebx
mov edx, dword [ebp - 0x34]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x450b44
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x450b54
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.QQPCMgr.qbox_shell
push SysReAllocString
call esi
test eax, eax
mov eax, dword [ebp - 0x2c]
jne 0x450b9b
test eax, eax
je 0x450ba2
push 2
push 0x4ed230
push 1
push 0
push 0x4ed230
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x450ba2
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.QQPCMgr.qbox_shellopen
push SysReAllocString
call esi
test eax, eax
mov eax, dword [ebp - 0x2c]
jne 0x450be9
test eax, eax
je 0x450bf0
push 0x10
push 0x4f2c08
push 1
push 0
push 0x4ed230
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x450bf0
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.QQPCMgr.qbox_shellcommand
push SysReAllocString
call esi
test eax, eax
jne 0x450c87
mov edx, dword [ebp - 0x3c]
lea ecx, [ebp - 0x34]
push str.QQPCFileSafe.exe___1_
lea edx, [edx + 4]
call fcn.0041c010
add esp, 4
mov esi, dword [eax]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x450c66
mov edx, esi
lea ecx, [edx + 2]
mov dword [ebp - 0x38], ecx
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x450c41
sub edx, dword [ebp - 0x38]
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push esi
push 1
push 0
push 0x4ed230
push eax
call ebx
mov edx, dword [ebp - 0x34]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x450c81
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x450c91
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x450e7e
push 0x4eecc0
lea ecx, [ebp - 0x34]
call fcn.0041c970
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 1
mov edx, dword [eax + 4]
test edx, edx
jne 0x450cde
xor ecx, ecx
jmp 0x450cf2
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x450ce3
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x34]
call fcn.0041c490
push 0xd
push str.QQPCTray.exe_
lea ecx, [ebp - 0x34]
call fcn.0041c490
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x450d5f
mov ecx, dword [ebp - 0x34]
mov esi, ecx
lea edx, [esi + 2]
mov dword [ebp - 0x38], edx
nop dword [eax]
mov dx, word [esi]
add esi, 2
test dx, dx
jne 0x450d20
sub esi, dword [ebp - 0x38]
sar esi, 1
lea edx, [esi*2 + 2]
push edx
push ecx
push 1
push 0
push str.DisplayIcon
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x450d5f
push 0xa
push 0x4f2d2c
push 1
push 0
push 0x4f03d0
push eax
call ebx
push 1
push 0x4eecc0
lea ecx, [ebp - 0x34]
call fcn.0041ccd0
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + 4]
test edx, edx
jne 0x450d7c
xor ecx, ecx
jmp 0x450d90
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x450d81
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x34]
call fcn.0041c490
push 0xb
push str.Uninst.exe_
lea ecx, [ebp - 0x34]
call fcn.0041c490
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x450de8
mov ecx, dword [ebp - 0x34]
mov esi, ecx
lea edx, [esi + 2]
mov dword [ebp - 0x38], edx
nop dword [eax + eax]
mov dx, word [esi]
add esi, 2
test dx, dx
jne 0x450dc0
sub esi, dword [ebp - 0x38]
sar esi, 1
lea edx, [esi*2 + 2]
push edx
push ecx
push 1
push 0
push str.UninstallString
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x3c]
mov esi, dword [ecx + 0xc]
test eax, eax
je 0x450e59
mov edx, esi
lea ecx, [edx + 2]
mov dword [ebp - 0x38], ecx
nop word [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x450e00
sub edx, dword [ebp - 0x38]
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push esi
push 1
push 0
push 0x4f2d70
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x450e59
push 0x4e
push str.http:__pc.qq.com_pc_softmgr_index.html
push 1
push 0
push str.URLInfoAbout
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x450e59
push 0x1a
push 0x4f2dfc
push 1
push 0
push str.Publisher
push eax
call ebx
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x450e78
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x450e88
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSet_servicesQQPCRTP
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
mov eax, dword [ebp - 0x2c]
jne 0x450ed5
mov dword [ebp - 0x38], 0
test eax, eax
je 0x450edc
push 4
lea ecx, [ebp - 0x38]
push ecx
push 4
push 0
push str.RtpFlag
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x450edc
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARETencent
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
mov eax, dword [ebp - 0x2c]
jne 0x450f23
test eax, eax
je 0x450f2a
push 4
push 0x4ee158
push 1
push 0
push str.QQPCFlag
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x450f2a
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x45143c
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov edx, dword [eax + 4]
xor eax, eax
mov word [ebp - 0x28], ax
cmp word [edx], ax
jne 0x450f7b
xor ecx, ecx
jmp 0x450f8f
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x450f80
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00439160
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0048a1a0
cmp dword [ebp - 0x14], 8
lea edi, [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
cmovae edi, dword [ebp - 0x28]
xor esi, esi
test eax, eax
je 0x450ff0
mov edx, edi
lea ecx, [edx + 2]
mov dword [ebp - 0x38], ecx
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x450fc1
sub edx, dword [ebp - 0x38]
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push edi
push 1
push 0
push str.InstallDir
push eax
call ebx
test eax, eax
mov eax, 1
cmove esi, eax
push esi
push str.WriteReg_InstallDir__Result_:__d
push 0x515488
call fcn.0048d4b0
mov ecx, dword [ebp - 0x3c]
add esp, 0xc
cmp dword [ecx + 0x1c], 0
je 0x451017
test esi, esi
je 0x451017
mov eax, 1
jmp 0x451019
xor eax, eax
mov edi, dword [ecx + 0xc]
xor esi, esi
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x45105f
mov edx, edi
lea ecx, [edx + 2]
mov dword [ebp - 0x38], ecx
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x451030
sub edx, dword [ebp - 0x38]
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push edi
push 1
push 0
push str.Version
push eax
call ebx
test eax, eax
mov eax, 1
cmove esi, eax
push esi
push str.WriteReg_Version__Result_:__d
push 0x515488
call fcn.0048d4b0
mov ecx, dword [ebp - 0x3c]
add esp, 0xc
cmp dword [ecx + 0x1c], 0
je 0x451086
test esi, esi
je 0x451086
mov eax, 1
jmp 0x451088
xor eax, eax
mov dword [ecx + 0x1c], eax
lea edx, [ecx + 4]
push str.QQPCMgr.exe
lea ecx, [ebp - 0x38]
call fcn.0041c010
add esp, 4
mov esi, dword [eax]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4510d4
mov edx, esi
lea edi, [edx + 2]
nop dword [eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x4510b0
sub edx, edi
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push esi
push 1
push 0
push str.ExeString
push eax
call ebx
mov edx, dword [ebp - 0x38]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4510ef
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], 1
test eax, eax
je 0x451112
push 4
lea ecx, [ebp - 0x38]
push ecx
push 4
push 0
push str.IdleScanTip
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], 0
test eax, eax
je 0x451132
push 4
lea ecx, [ebp - 0x38]
push ecx
push 4
push 0
push str.FirstRun
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], 1
test eax, eax
je 0x451152
push 4
lea ecx, [ebp - 0x38]
push ecx
push 4
push 0
push str.IsTrayCrashed
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], 1
test eax, eax
je 0x451172
push 4
lea ecx, [ebp - 0x38]
push ecx
push 4
push 0
push str.autostart
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x451190
lea eax, [ecx + 1]
push eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00433600
mov eax, dword [ebp - 0x2c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4511a3
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARETencentQQPCMgrVulFW
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
mov eax, dword [ebp - 0x2c]
jne 0x4511f0
mov dword [ebp - 0x38], 1
test eax, eax
je 0x4511f7
push 4
lea ecx, [ebp - 0x38]
push ecx
push 4
push 0
push str.bCameraProtection
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4511f7
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
mov eax, dword [ebp - 0x2c]
jne 0x45124a
test eax, eax
je 0x451251
push str.QMTray
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x451251
push 0x4f303c
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x451251
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunQQDisabled
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
mov eax, dword [ebp - 0x2c]
jne 0x4512a4
test eax, eax
je 0x4512ab
push 0x4f303c
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4512ab
push str._QQPCTray
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4512ab
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x451374
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x30]
add eax, 4
mov edx, 0x4eecc0
push eax
call fcn.00438410
push str.QQPCTray.exe___regrun
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x34]
call fcn.0041c010
add esp, 8
mov esi, dword [eax]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x451339
mov edx, esi
lea ecx, [edx + 2]
mov dword [ebp - 0x38], ecx
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x451314
sub edx, dword [ebp - 0x38]
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push esi
push 1
push 0
push str._QQPCTray
push eax
call ebx
mov edx, dword [ebp - 0x34]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x451356
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x451374
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x511ea4]
cmp eax, 0xffffffff
jne 0x4513ba
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x451444
push 0x511ea4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x451444
mov eax, dword [0x511ea4]
test eax, eax
jne 0x451453
push str.Set_TSKSP_autostart
push 0x515488
call fcn.0048d4b0
mov eax, dword [ebp - 0x2c]
add esp, 8
test eax, eax
je 0x4513de
push eax
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2c]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTSKSP
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2c], 0
call esi
test eax, eax
jne 0x451428
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x451428
push 4
push 0x4ee158
push 1
push 0
push str.autostart
push eax
call ebx
push str.Set_TSKSP_autostart_end
push 0x515488
call fcn.0048d4b0
add esp, 8
jmp 0x451459
mov eax, dword [ebp - 0x2c]
jmp 0x45119c
mov dword [0x511ea4], 0
jmp 0x4513c2
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push str.Set_QQSoftMgr_reg
push 0x515488
call fcn.0048d4b0
mov eax, dword [ebp - 0x2c]
add esp, 8
test eax, eax
je 0x451475
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARETENCENTDeskUpdateQQSoftMgr
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x4515c3
mov edx, dword [ebp - 0x3c]
lea ecx, [ebp - 0x30]
add edx, 4
push str.QQPCSoftMgr.exe
call fcn.0041c010
add esp, 4
mov esi, dword [eax]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4514eb
mov edx, esi
lea edi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x4514c7
sub edx, edi
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push esi
push 1
push 0
push str.ExeString
push eax
call ebx
mov edx, dword [ebp - 0x30]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x451506
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.0041bed0
mov ecx, eax
test ecx, ecx
jne 0x45151b
push 0x80004005
call fcn.0041cdf0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 4
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00440780
mov esi, dword [ebp - 0x34]
test eax, eax
je 0x4515a7
mov eax, dword [esi - 0xc]
test eax, eax
je 0x4515a7
mov eax, dword [ebp - 0x3c]
push ecx
mov edi, esp
mov dword [ebp - 0x30], edi
mov ecx, dword [eax + 4]
sub ecx, 0x10
call fcn.0041c670
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x30]
push eax
call fcn.00453c80
lea ecx, [ebp - 0x2c]
push dword [eax]
push str.InstallDir
call fcn.00440870
mov edx, dword [ebp - 0x30]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x451595
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.0.500
push str.Version
lea ecx, [ebp - 0x2c]
call fcn.00440870
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4515c3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push str.Set_TsFltMgr_reg
push 0x515488
call fcn.0048d4b0
add esp, 8
cmp dword [0x511ea4], 0xffffffff
jne 0x451619
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x45160d
push 0x511ea4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
jne 0x451619
mov dword [0x511ea4], 0
jmp 0x451626
cmp dword [0x511ea4], 0
jne 0x451f08
mov eax, dword [ebp - 0x2c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x451636
push eax
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2c]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTsFltMgr
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2c], 0
call esi
test eax, eax
jne 0x451875
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x45167d
push str.DeleteFlag
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x28]
call fcn.0048b220
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.0048eba0
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
cmovae esi, dword [ebp - 0x28]
test eax, eax
je 0x4516d5
mov edx, esi
lea ecx, [edx + 2]
mov dword [ebp - 0x30], ecx
nop dword [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x4516b0
sub edx, dword [ebp - 0x30]
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push esi
push 1
push 0
push str.InstallDir
push eax
call ebx
push str.TsFltMgr.sys
lea ecx, [ebp - 0x34]
call fcn.0041c970
mov byte [ebp - 4], 6
call fcn.0048a150
test eax, eax
je 0x4516fc
push str.TsFltMgr_ev.sys
lea ecx, [ebp - 0x34]
call fcn.0041cd80
push dword [ebp - 0x34]
lea ecx, [ebp - 0x28]
call fcn.0048eea0
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x30]
lea edx, [edx + 4]
call fcn.00421dd0
add esp, 4
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae ecx, dword [ebp - 0x28]
push 0
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edx, dword [ebp - 0x30]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45174f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45181a
lea eax, [ebp - 0x34]
mov edx, str.System32drivers_
push eax
lea ecx, [ebp - 0x30]
call fcn.00438410
add esp, 4
lea ecx, [ebp - 0x2c]
push dword [eax]
push str.ImagePath
call fcn.00440870
mov edx, dword [ebp - 0x30]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4517a6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
test eax, eax
je 0x4517c9
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.ErrorControl
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
test eax, eax
je 0x4517e9
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.Start
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 1
test eax, eax
je 0x451806
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.Type
push eax
call ebx
push str.TsFltMgr
push 0x4f03d0
lea ecx, [ebp - 0x2c]
call fcn.00440870
jmp 0x451838
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.Not_Found__ws
push 0x515488
call fcn.0048d4b0
add esp, 0xc
mov byte [ebp - 4], 5
mov eax, esi
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x451856
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x45186f
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00433600
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push str.WriteRegStr_TSKSP_..begin
push 0x515488
call fcn.0048d4b0
mov eax, dword [ebp - 0x2c]
add esp, 8
test eax, eax
je 0x451891
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTSKSP
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x451acd
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4518d2
push str.DeleteFlag
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x28]
push dword [eax + 4]
call fcn.00438660
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 7
call fcn.0048eba0
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
cmovae esi, dword [ebp - 0x28]
test eax, eax
je 0x45192b
mov edx, esi
lea ecx, [edx + 2]
mov dword [ebp - 0x30], ecx
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x451906
sub edx, dword [ebp - 0x30]
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push esi
push 1
push 0
push str.InstallDir
push eax
call ebx
push str.TSKsp.sys
lea ecx, [ebp - 0x34]
call fcn.0041c970
mov byte [ebp - 4], 8
call fcn.0048a150
test eax, eax
je 0x451952
push str.TSKsp_ev.sys
lea ecx, [ebp - 0x34]
call fcn.0041cd80
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x30]
lea edx, [edx + 4]
call fcn.00421dd0
add esp, 4
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x30]
mov esi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x45198c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x451a8d
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x38]
add eax, 4
mov edx, 0x4f0364
push eax
call fcn.00438410
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 9
push ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00421dd0
add esp, 8
lea ecx, [ebp - 0x2c]
push dword [eax]
push str.ImagePath
call fcn.00440870
mov edx, dword [ebp - 0x30]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4519e9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 8
mov eax, esi
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x451a07
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
test eax, eax
je 0x451a2a
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.ErrorControl
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 1
test eax, eax
je 0x451a4a
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.Start
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 1
test eax, eax
je 0x451a67
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.Type
push eax
call ebx
push str.TSKSP
push 0x4f03d0
lea ecx, [ebp - 0x2c]
call fcn.00440870
push 0x4ee158
push str.autostart
lea ecx, [ebp - 0x2c]
call fcn.00440870
jmp 0x451a90
or esi, 0xffffffff
mov byte [ebp - 4], 7
mov eax, esi
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x451aae
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x451ac7
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00433600
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push str.WriteRegStr_TSKSP_..end
push 0x515488
call fcn.0048d4b0
mov eax, dword [ebp - 0x2c]
add esp, 8
test eax, eax
je 0x451ae9
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTSSysKit
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x451cfd
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x451b2a
push str.DeleteFlag
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x28]
push dword [eax + 4]
call fcn.00438660
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xa
call fcn.0048eba0
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
cmovae esi, dword [ebp - 0x28]
test eax, eax
je 0x451b85
mov edx, esi
lea ecx, [edx + 2]
mov dword [ebp - 0x30], ecx
nop
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x451b60
sub edx, dword [ebp - 0x30]
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push esi
push 1
push 0
push str.InstallDir
push eax
call ebx
push 0x4f0a60
lea ecx, [ebp - 0x34]
call fcn.0041c970
mov byte [ebp - 4], 0xb
call fcn.0048a150
test eax, eax
je 0x451bac
push str.TSSysKit_ev.sys
lea ecx, [ebp - 0x34]
call fcn.0041cd80
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x30]
lea edx, [edx + 4]
call fcn.00421dd0
add esp, 4
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x30]
mov esi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x451be6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x451cc3
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x38]
add eax, 4
mov edx, 0x4f0364
push eax
call fcn.00438410
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xc
push ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00421dd0
add esp, 8
lea ecx, [ebp - 0x2c]
push dword [eax]
push str.ImagePath
call fcn.00440870
mov edx, dword [ebp - 0x30]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x451c43
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xb
mov eax, esi
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x451c61
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
test eax, eax
je 0x451c84
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.ErrorControl
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 1
test eax, eax
je 0x451ca4
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.Start
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 1
test eax, eax
je 0x451cc6
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.Type
push eax
call ebx
jmp 0x451cc6
or esi, 0xffffffff
mov byte [ebp - 4], 0xa
mov eax, esi
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x451ce4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x451cfd
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00433600
mov edx, dword [ebp - 0x3c]
lea ecx, [ebp - 0x30]
add edx, 4
push str.QMIEProtect.sys
call fcn.0041c010
add esp, 4
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x30]
mov esi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x451d38
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x451f0e
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x451d4a
push eax
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2c]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesQMIEProtect
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2c], 0
call esi
test eax, eax
jne 0x451f0e
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x451d91
push str.DeleteFlag
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, dword [ebp - 0x3c]
lea ecx, [ebp - 0x28]
add esi, 4
push dword [esi]
call fcn.00438660
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xd
call fcn.0048eba0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x28]
push eax
push str.InstallDir
call fcn.00440870
push str.QMIEProtect.sys
lea ecx, [ebp - 0x34]
call fcn.0041c970
mov byte [ebp - 4], 0xe
call fcn.0048a150
test eax, eax
je 0x451ded
push str.QMIEProtect_ev.sys
lea ecx, [ebp - 0x34]
call fcn.0041cd80
push esi
mov edx, 0x4f0364
lea ecx, [ebp - 0x38]
call fcn.00438410
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xf
push ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00421dd0
add esp, 8
lea ecx, [ebp - 0x2c]
push dword [eax]
push str.ImagePath
call fcn.00440870
mov edx, dword [ebp - 0x30]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x451e3c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe
mov eax, esi
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x451e5a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
test eax, eax
je 0x451e7d
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.ErrorControl
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 2
test eax, eax
je 0x451e9d
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.Start
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 1
test eax, eax
je 0x451eba
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.Type
push eax
call ebx
push str.QMIEProtect
push 0x4f03d0
lea ecx, [ebp - 0x2c]
call fcn.00440870
push 0x4ee158
push str.autostart
lea ecx, [ebp - 0x2c]
call fcn.00440870
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x451efa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.004335b0
jmp 0x451f0e
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x511ea4], 0xffffffff
jne 0x451f55
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x451f46
push 0x511ea4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
jne 0x451f55
mov dword [0x511ea4], 0
jmp 0x452031
cmp dword [0x511ea4], 0
je 0x452031
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x451f6c
push eax
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2c]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesQQSysMonX64
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2c], 0
call esi
test eax, eax
jne 0x452037
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x451fb3
push str.DeleteFlag
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x28]
push dword [eax + 4]
call fcn.00438660
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x10
call fcn.0048eba0
mov ecx, dword [ebp - 0x14]
lea esi, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 8
mov eax, dword [ebp - 0x2c]
cmovae esi, edx
test eax, eax
je 0x45201b
mov edx, esi
lea ecx, [edx + 2]
mov dword [ebp - 0x30], ecx
nop dword [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x451ff0
sub edx, dword [ebp - 0x30]
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push esi
push 1
push 0
push str.InstallDir
push eax
call ebx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
mov byte [ebp - 4], 0
cmp ecx, 8
jb 0x452031
lea eax, [ecx + 1]
push eax
push edx
lea ecx, [ebp - 0x28]
call fcn.00433600
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [0x515428], 0
jne 0x452122
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0x11
push eax
push 0x20019
push 0
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x452114
lea eax, [ebp - 0x38]
push eax
push 0x4f338c
lea ecx, [ebp - 0x34]
call fcn.004338c0
mov eax, dword [ebp - 0x38]
cmp eax, 0x7270e00
jb 0x45209b
cmp eax, 0x7bfa47f
jbe 0x4520a7
add eax, 0xfffe2b3f
cmp eax, 0x270e
ja 0x452114
call fcn.0048a560
test eax, eax
mov eax, dword [ebp - 0x2c]
jne 0x4520d4
test eax, eax
je 0x4520ba
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesQQSysMon
jmp 0x4520f3
test eax, eax
je 0x4520db
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesQQSysMonX64
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2c], 0
call esi
test eax, eax
jne 0x452114
push 3
push str.spvalue
lea ecx, [ebp - 0x2c]
call fcn.00440840
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x452122
push eax
call edi
mov ebx, dword [ebp - 0x3c]
lea ecx, [ebx + 0xc]
call fcn.004404e0
test eax, eax
jne 0x4521b0
mov edx, dword [ebx + 4]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
cmp word [edx], ax
jne 0x45214f
xor ecx, ecx
jmp 0x452163
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x452154
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00439160
push str.PluginsQQPCB1AndroidJmp_
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x12
call fcn.0048eea0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
call fcn.0048a400
test eax, eax
je 0x45219b
lea eax, [ebp - 0x28]
push eax
call fcn.00452c20
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4521b0
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00433600
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4521ba
push eax
call edi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret