Function at 0x436240
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push esi
push edi
push ecx
lea edi, [ebp - 0x14c]
mov ecx, 0x53
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xf0], SysReAllocString
mov dword [ebp - 0xec], 0x4b2a88
mov dword [ebp - 0xe8], SysReAllocString
mov dword [ebp - 0xe4], 0x4b2a94
mov dword [ebp - 0xe0], SysReAllocString
mov dword [ebp - 0xdc], 0x4b2aa8
mov dword [ebp - 0xd8], SysReAllocString
mov dword [ebp - 0xd4], 0x4b2ab4
mov dword [ebp - 0xd0], SysReAllocString
mov dword [ebp - 0xcc], 0x4b2ad0
mov dword [ebp - 0xc8], SysReAllocString
mov dword [ebp - 0xc4], 0x4b2adc
mov dword [ebp - 0xc0], SysReAllocString
mov dword [ebp - 0xbc], str..qpak
mov dword [ebp - 0xb8], SysReAllocString
mov dword [ebp - 0xb4], str.qpakfile
mov dword [ebp - 0xb0], SysReAllocString
mov dword [ebp - 0xac], str..qbox
mov dword [ebp - 0xa8], SysReAllocString
mov dword [ebp - 0xa4], str.QQPCMgr.qbox
mov dword [ebp - 0xa0], SysReAllocString
mov dword [ebp - 0x9c], str..qmb
mov dword [ebp - 0x98], SysReAllocString
mov dword [ebp - 0x94], str.qmbfile
mov dword [ebp - 0x90], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x8c], 0x4b2b50
mov dword [ebp - 0x88], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x84], str.SoftwareMicrosoftWindowsCurrentVersionUninstallQQPCMgr
mov dword [ebp - 0x80], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], str.SOFTWARETENCENTDeskUpdateQQSoftMgr
mov dword [ebp - 0x78], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x74], 0x4b2c60
mov dword [ebp - 0x70], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x6c], str.SYSTEMCurrentControlSetServicesTSSysKit
mov dword [ebp - 0x68], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x64], str.SYSTEMCurrentControlSetServicesTsNetMon
mov dword [ebp - 0x60], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x5c], str.SYSTEMCurrentControlSetServicesTSCPM
mov dword [ebp - 0x58], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x54], str.SYSTEMCurrentControlSetServicesQQFolderCrypt
mov dword [ebp - 0x50], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x4c], str.SYSTEMCurrentControlSetServicesTCSafeBox
mov dword [ebp - 0x48], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x44], str.SYSTEMCurrentControlSetServicesQQFileFilter
mov dword [ebp - 0x40], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x3c], str.SYSTEMCurrentControlSetServicesQqNetflpwControl
mov dword [ebp - 0x38], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x34], str.SYSTEMCurrentControlSetServicesTSCPM64
mov dword [ebp - 0x30], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2c], str.SYSTEMCurrentControlSetServicesQQSysMon
mov dword [ebp - 0x28], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x24], str.SYSTEMCurrentControlSetServicesQQSysMonX64
mov dword [ebp - 0x20], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1c], str.SYSTEMCurrentControlSet_servicesTSDefenseBt
mov dword [ebp - 0x18], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], str.SYSTEMCurrentControlSet_servicesQQPCHelper
mov dword [ebp - 0x10], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], str.SYSTEMCurrentControlSet_servicesQMIEProtect
mov dword [ebp - 0xf8], 0
jmp 0x436467
mov eax, dword [ebp - 0xf8]
add eax, 1
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0x1d
jae 0x436496
mov ecx, dword [ebp - 0xf8]
mov edx, dword [ebp + ecx*8 - 0xec]
push edx
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp + eax*8 - 0xf0]
push ecx
call fcn.004343f0
add esp, 8
jmp 0x436458
mov dword [ebp - 0x144], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x140], 0x4b31d8
mov dword [ebp - 0x13c], 0x4b2c4c
mov dword [ebp - 0x138], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x134], 0x4b3238
mov dword [ebp - 0x130], str.QQPCLaunch
mov dword [ebp - 0x12c], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x128], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [ebp - 0x124], str._QQPCTray
mov dword [ebp - 0x120], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x11c], str.SYSTEMCurrentControlSetServicesTSKSP
mov dword [ebp - 0x118], 0x4b3370
mov dword [ebp - 0x114], SysReAllocString
mov dword [ebp - 0x110], str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov dword [ebp - 0x10c], str.QQPCClinic
mov dword [ebp - 0x108], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x104], str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov dword [ebp - 0x100], str.QQPCTray
mov dword [ebp - 0x14c], 0
jmp 0x436565
mov edx, dword [ebp - 0x14c]
add edx, 1
mov dword [ebp - 0x14c], edx
cmp dword [ebp - 0x14c], 6
jae 0x4365ab
mov eax, dword [ebp - 0x14c]
imul eax, eax, 0xc
mov ecx, dword [ebp + eax - 0x13c]
push ecx
mov edx, dword [ebp - 0x14c]
imul edx, edx, 0xc
mov eax, dword [ebp + edx - 0x140]
push eax
mov ecx, dword [ebp - 0x14c]
imul ecx, ecx, 0xc
mov edx, dword [ebp + ecx - 0x144]
push edx
call fcn.00434500
add esp, 0xc
jmp 0x436556
push str.CallUnRegUrlProtocol
mov esi, 0x4ca290
call fcn.0045f140
add esp, 4
push str.QQPCMgr.WebGame
mov ecx, dword [ebp - 4]
call fcn.00437430
push str.QQPCMgr.QQPCSafebox
mov ecx, dword [ebp - 4]
call fcn.00437430
push str.PCMgrRepairIEExtensions
mov ecx, dword [ebp - 4]
call fcn.00437430
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x43660c]
call fcn.0049f901
pop eax
pop edx
pop edi
pop esi
add esp, 0x14c
cmp ebp, esp
call fcn.0049f8de
mov esp, ebp
pop ebp
ret