Function at 0x10001510
Capabilities:
Get file version info
Terminate thread

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10c
push ebx
push ebp
mov ebp, 1
push esi
cmp eax, ebp
push edi
jne 0x1000194d
mov esi, dword [esp + 0x120]
push esi
push 0x10066190
call sub.MFC42.DLL_AfxInitExtensionModule
test eax, eax
je 0x10001677
push 0x40
call sub.MFC42.DLL_operatornew
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x10001562
push ebx
push 0x10066190
mov ecx, eax
call sub.MFC42.DLL_CDynLinkLibrary::CDynLinkLibrary
push str._____________77add
mov dword [0x10011914], esi
call fcn.10003300
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 4
push str.KernelUtil.dll
call esi
test eax, eax
je 0x10001735
push 0x1000f250
call fcn.10003300
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], bl
rep stosd dword es:[edi], eax
add esp, 4
stosw word es:[edi], ax
push str.QQ.exe
stosb byte es:[edi], al
call esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x100016be
lea edx, [esp + 0x18]
push edx
push str.get_qq_szPath:__s
call fcn.10003300
add esp, 8
lea eax, [esp + 0x18]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebx
jne 0x1000161a
push str.Error_in_GetFileVersionInfoSize
call fcn.10003300
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
push edi
call sub.MFC42.DLL_operatornew
add esp, 4
mov esi, eax
lea ecx, [esp + 0x18]
push esi
push edi
push ebx
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x10001644
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_in_GetFileVersionInfo:__d_n
jmp 0x10001669
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
push 0x1000f1ec
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x10001686
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_in_VerQueryValue:__d_n
call fcn.10003300
push esi
call sub.MFC42.DLL_operatordelete
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret 0xc
push esi
call sub.MFC42.DLL_operatordelete
mov ecx, dword [esp + 0x14]
add esp, 4
cmp dword [ecx + 8], 0x1004b
jb 0x100016b1
push str.QQ2012
call fcn.10003300
add esp, 4
mov dword [0x10066174], ebp
jmp 0x100016be
push str.QQ2009___QQ2011
call fcn.10003300
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x100118f8
call esi
push 0x100118e0
call esi
call fcn.10006ce0
test eax, eax
jne 0x100016f7
push str.Setup_Api_Hook_Failed_
call fcn.10003300
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
push str.Setup_Api_Success_
call fcn.10003300
add esp, 4
call fcn.10001a50
test eax, eax
jne 0x1000171a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
mov dword [0x1006614c], ebp
mov dword [0x10066154], 3
mov dword [0x10066148], ebp
jmp 0x1000181b
push str.QQ.exe
call esi
test eax, eax
je 0x1000176d
call fcn.10001a50
test eax, eax
jne 0x10001756
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
mov dword [0x1006614c], ebp
mov dword [0x10066154], ebp
mov dword [0x10066148], ebp
jmp 0x1000181b
push str.TM.exe
call esi
test eax, eax
je 0x100017a6
call fcn.10001a50
test eax, eax
jne 0x1000178e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
mov dword [0x1006614c], ebp
mov dword [0x10066154], 2
mov dword [0x10066148], ebp
jmp 0x1000181b
push str.WLDCore.dll
call esi
test eax, eax
je 0x1000184f
push 0x1000f168
call fcn.10003300
add esp, 4
push str.ShellDll.dll
call esi
test eax, eax
je 0x10001900
call fcn.10001a50
test eax, eax
jne 0x100017e7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
mov dword [0x1006614c], 0x10
mov dword [0x10066158], 4
mov dword [0x10066148], ebp
push 0x1000f140
call fcn.10003300
mov eax, dword [0x10066148]
add esp, 4
cmp eax, ebx
je 0x10001a3c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x10066150], eax
mov ecx, 0xd2
xor eax, eax
mov edi, 0x10065d78
rep stosd dword es:[edi], eax
mov ecx, 0x21
mov edi, 0x100660c0
rep stosd dword es:[edi], eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
push str.MSNCore.dll
call esi
test eax, eax
je 0x100018b0
push 0x1000f124
call fcn.10003300
add esp, 4
push str.ShellDll.dll
call esi
test eax, eax
je 0x10001900
call fcn.10001a50
test eax, eax
jne 0x1000188c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
mov dword [0x1006614c], 0x10
mov dword [0x10066158], 3
mov dword [0x10066148], ebp
push 0x1000f10c
jmp 0x10001806
push str.Skype.exe
call esi
test eax, eax
jne 0x1000190f
push str.Skype_Internet_Telephoney
call esi
test eax, eax
jne 0x1000190f
push str.NscAuth.exe
call esi
test eax, eax
je 0x100018f3
push 0x1000f0c8
call fcn.10003300
add esp, 4
mov eax, ebp
mov dword [0x10066148], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
push 0x1000f0b4
call fcn.10003300
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret 0xc
push 0x1000f0a8
call fcn.10003300
add esp, 4
call fcn.10001a50
test eax, eax
jne 0x10001932
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
mov dword [0x1006614c], 0x100
mov dword [0x1006615c], ebp
mov dword [0x10066148], ebp
jmp 0x1000181b
xor ebx, ebx
cmp eax, ebx
jne 0x100019fc
cmp dword [0x10066148], ebx
je 0x100019d5
call fcn.10001de0
cmp dword [0x1006614c], ebp
jne 0x1000199b
cmp dword [0x10066154], 3
jne 0x1000199b
call fcn.10006da0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x100118f8
call esi
push 0x100118e0
call esi
push str.QQ2009_UnHook_API_
call fcn.10003300
add esp, 4
mov eax, dword [0x10066144]
cmp eax, ebx
je 0x100019bf
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push str.Terminate_Net_Transe_Thread
mov dword [0x10066144], ebx
call fcn.10003300
add esp, 4
mov eax, dword [0x1004eca8]
cmp eax, ebx
je 0x100019d5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1004eca8], ebx
push str.Audit_Moudle_Process_DETACH_
call fcn.10003300
add esp, 4
push ebx
push 0x10066190
call sub.MFC42.DLL_AfxTermExtensionModule
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
cmp eax, 3
je 0x10001a3c
cmp eax, 2
jne 0x10001a3c
cmp dword [0x10066148], ebx
je 0x10001a3c
cmp dword [0x10011918], ebx
je 0x10001a1e
cmp dword [0x10011920], ebx
jne 0x10001a3c
cmp dword [0x10011924], ebx
jne 0x10001a3c
call fcn.10001ac0
test eax, eax
jne 0x10001a3c
push 0x1000f044
call fcn.10003300
add esp, 4
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc