Function at 0x406f40
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x4e5a78
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50f130]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x44]
lea eax, [esp + 0x20]
push eax
call fcn.004060b0
xor edi, edi
mov dword [esp + 0x3c], edi
mov eax, dword [esp + 0x24]
cmp eax, edi
je 0x406f9c
mov ecx, dword [esp + 0x28]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x406fd6
push str.677B9715_5692_49f6_979F_CD11EC963EFE
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, edi
je 0x407559
mov dword [0x5157dc], eax
push 0x4efe38
mov ecx, 0x515890
mov dword [ebp + 0x38], edi
call fcn.004899e0
add esp, 4
mov dword [ebp + 4], 1
jmp 0x407559
mov edx, dword [0x5143ac]
mov eax, dword [edx + 0xc]
mov ecx, 0x5143ac
call eax
add eax, 0x10
mov dword [esp + 0x44], eax
lea ecx, [esp + 0x44]
push ecx
mov ebx, 1
push 0x4efe44
lea eax, [esp + 0x28]
mov byte [esp + 0x44], bl
call fcn.00406350
test eax, eax
je 0x407010
mov dword [ebp + 4], ebx
lea edx, [esp + 0x44]
push edx
push 0x4efe48
lea eax, [esp + 0x28]
call fcn.00406350
test eax, eax
je 0x40702a
mov dword [ebp + 4], ebx
lea eax, [esp + 0x44]
push eax
push str.showtips
lea eax, [esp + 0x28]
call fcn.00406350
test eax, eax
je 0x407044
mov dword [ebp + 8], ebx
lea ecx, [esp + 0x44]
push ecx
push str.filedestroy
lea eax, [esp + 0x28]
call fcn.00406350
test eax, eax
je 0x40705e
mov dword [ebp + 0xc], ebx
lea edx, [esp + 0x44]
push edx
push str.DbgExtract
lea eax, [esp + 0x28]
call fcn.00406350
test eax, eax
je 0x4070f2
lea eax, [ebp + 0x1c]
push eax
push str.DbgExtractpath
lea eax, [esp + 0x28]
call fcn.00406350
test eax, eax
jne 0x4070bf
mov byte [esp + 0x3c], al
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4070af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ebx, [esp + 0x20]
call fcn.00408520
xor eax, eax
jmp 0x407567
lea ecx, [ebp + 0x20]
push ecx
push str.DbgExtractFiles
lea eax, [esp + 0x28]
call fcn.00406350
mov byte [esp + 0x3c], 0
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
mov dword [ebp + 0x18], ebx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x40754d
lea ecx, [esp + 0x44]
push ecx
push str.recommand
lea eax, [esp + 0x28]
call fcn.00406350
test eax, eax
je 0x40714f
mov esi, dword [esp + 0x44]
push esi
push str.supply_is__s
mov ecx, 0x515890
call fcn.004899e0
push esi
call fcn.004b84fe
mov ecx, 4
add esp, 0xc
test cl, al
jne 0x407131
xor ecx, ecx
test al, 8
jne 0x40713a
cmp ecx, 8
jne 0x407144
call fcn.004121a0
jmp 0x4071ec
mov dword [0x515694], ecx
jmp 0x4071ec
push edi
lea edx, [esp + 0x1c]
push edx
push edi
push 0xf003f
push edi
push edi
push edi
push str.SOFTWARETencentQQPCMgr
mov byte [esp + 0x5c], 2
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x4071d9
lea eax, [esp + 0x1c]
push eax
push str.ExtendQQNavigation
lea eax, [esp + 0x20]
call fcn.004096b0
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x4071a6
push str.ExtendQQNavigation
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0x1c]
cmp eax, 0xb
jne 0x4071bc
call fcn.004121a0
mov dword [0x515698], edi
jmp 0x4071d9
cmp eax, 0xc
jne 0x4071ce
call fcn.004121a0
mov dword [0x515698], ebx
jmp 0x4071d9
cmp eax, 0xd
jne 0x4071d9
mov dword [0x51569c], ebx
mov byte [esp + 0x3c], bl
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x4071ec
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x44]
push ecx
push str.installpath
lea eax, [esp + 0x28]
call fcn.00406350
test eax, eax
je 0x407257
lea eax, [esp + 0x44]
call fcn.00421450
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x1c]
push edx
call fcn.0040d290
lea edi, [esp + 0x44]
mov byte [esp + 0x3c], 3
call fcn.004013f0
mov byte [esp + 0x3c], bl
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40724c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esp + 0x44]
call fcn.0040dda0
xor edi, edi
lea ecx, [esp + 0x44]
push ecx
push str.qqpcmgr
lea eax, [esp + 0x28]
call fcn.00406350
test eax, eax
je 0x40727e
mov edx, dword [esp + 0x44]
push edx
call fcn.004b84fe
add esp, 4
mov dword [ebp + 0x38], eax
lea eax, [esp + 0x44]
push eax
push str.update
lea eax, [esp + 0x28]
call fcn.00406350
test eax, eax
je 0x4072a7
mov ecx, dword [esp + 0x44]
push ecx
call fcn.004b84fe
add esp, 4
mov dword [0x5154d8], eax
lea edx, [esp + 0x44]
push edx
push str.runexe
lea eax, [esp + 0x28]
call fcn.00406350
test eax, eax
je 0x4072cc
lea edi, [ebp + 0x3c]
lea eax, [esp + 0x44]
call fcn.004013f0
xor edi, edi
lea eax, [esp + 0x44]
push eax
push str.runexeargv
lea eax, [esp + 0x28]
call fcn.00406350
test eax, eax
je 0x4072f1
lea edi, [ebp + 0x40]
lea eax, [esp + 0x44]
call fcn.004013f0
xor edi, edi
lea ecx, [esp + 0x44]
push ecx
push str.restallforbr
lea eax, [esp + 0x28]
call fcn.00406350
test eax, eax
je 0x407310
mov dword [ebp + 0x14], ebx
call fcn.0040b510
lea edx, [esp + 0x44]
push edx
push str.supply
lea eax, [esp + 0x28]
call fcn.00406350
test eax, eax
je 0x407349
mov esi, dword [esp + 0x44]
push esi
push str.supply_is__ws
mov ecx, 0x515890
call fcn.004899e0
push esi
call fcn.004b84fe
add esp, 0xc
mov dword [0x5157a8], eax
lea eax, [esp + 0x44]
push eax
push str.DefaultIE
lea eax, [esp + 0x28]
call fcn.00406350
test eax, eax
je 0x407385
mov ecx, dword [esp + 0x44]
push ecx
push str.DefaultIE_is__ws
mov ecx, 0x515890
call fcn.004899e0
add esp, 8
lea edi, [ebp + 0x44]
lea eax, [esp + 0x44]
call fcn.004013f0
xor edi, edi
lea edx, [esp + 0x44]
push edx
push str.handle
lea eax, [esp + 0x28]
call fcn.00406350
test eax, eax
je 0x4073be
mov esi, dword [esp + 0x44]
push esi
push str.handle_is__s
mov ecx, 0x515890
call fcn.004899e0
push esi
call fcn.004b84fe
add esp, 0xc
mov dword [0x5157dc], eax
lea eax, [esp + 0x44]
push eax
push str.DriverPath
lea eax, [esp + 0x28]
call fcn.00406350
test eax, eax
je 0x407446
mov eax, dword [esp + 0x44]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
call fcn.004012d0
add eax, 0x10
lea ecx, [esp + 0x20]
mov dword [esi], eax
call fcn.00407640
mov byte [esp + 0x3c], 4
mov ecx, dword [esp + 0x1c]
push ecx
push str.DriverPath_is__ws
mov ecx, 0x515890
call fcn.004899e0
add esp, 8
lea eax, [esp + 0x1c]
mov edi, 0x5157a0
call fcn.004013f0
mov byte [esp + 0x3c], bl
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407444
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor edi, edi
lea ecx, [esp + 0x44]
push ecx
push 0x4f0038
lea eax, [esp + 0x28]
call fcn.00406350
test eax, eax
mov esi, dword [esp + 0x44]
je 0x407538
mov dword [esp + 0x18], edi
mov byte [esp + 0x3c], 5
mov edx, dword [0x5143ac]
mov eax, dword [edx + 0xc]
mov ecx, 0x5143ac
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x3c], 6
mov eax, dword [esp + 0x18]
cmp eax, edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x40749b
push eax
call ebp
lea ecx, [esp + 0x18]
push ecx
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push str.Version
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x24]
call fcn.00409710
mov eax, dword [esp + 0x1c]
cmp dword [eax - 0xc], edi
je 0x407510
push 0x4f0068
mov ecx, 0x515890
call fcn.004899e0
add esp, 4
lea ecx, [esp + 0x1c]
call fcn.00416ce0
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x4074f6
push eax
call ebp
lea ecx, [esp + 0x44]
mov dword [esp + 0x18], edi
call fcn.00416ce0
lea ebx, [esp + 0x20]
call fcn.00408520
xor eax, eax
jmp 0x407567
push esi
call fcn.004b84fe
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [0x515668], ebx
mov dword [0x51566c], eax
call fcn.00416ce0
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x407538
push eax
call ebp
lea eax, [esi - 0x10]
mov byte [esp + 0x3c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407559
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ebx, [esp + 0x20]
call fcn.00408520
mov eax, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4