Function at 0x41c200
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x438
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x434], eax
push ebx
push ebp
push esi
push edi
call fcn.0041fdc0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x1c]
push eax
push 0x20019
xor edi, edi
push edi
push str.SOFTWARETencentTBH
mov esi, 1
push closesocket
mov dword [0x451500], esi
call ebx
test eax, eax
jne 0x41c251
mov dword [0x451504], esi
call fcn.0041fe50
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push edi
push str.SoftwareTencentQQCRM
push closesocket
mov dword [0x4514b0], edi
mov dword [0x4514b4], edi
mov dword [0x4514b8], esi
mov dword [0x4514bc], esi
mov dword [0x4514c0], esi
mov dword [0x4514c4], esi
mov dword [0x4514c8], esi
mov dword [0x4514cc], esi
mov dword [0x4514d0], esi
mov dword [0x4514d8], edi
call ebx
test eax, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jne 0x41c310
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x30]
push ecx
push edi
push str.Install
push edx
mov dword [esp + 0x40], 4
mov dword [esp + 0x3c], 0x104
call ebp
test eax, eax
jne 0x41c310
lea eax, [esp + 0x2c]
push eax
lea edx, [esp + 0x20]
lea ecx, [esp + 0x34]
call fcn.00424850
add esp, 4
test eax, eax
je 0x41c310
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov dword [0x4514b0], ecx
mov dword [0x4514b4], edx
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [esp + 0x238]
mov esi, str.YP_FOREXE_REG_PATH
call fcn.0041ba50
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push 0
mov edx, edi
push edx
push closesocket
call ebx
lea eax, [esp + 0x1c]
push 0x4514b0
push eax
call fcn.00417190
add esp, 8
test eax, eax
jne case.default.0x41c361
mov eax, dword [esp + 0x1c]
cmp eax, 3
ja case.default.0x41c361
jmp dword [eax*4 + 0x41c624]
mov dword [0x4514b4], 3
jmp case.default.0x41c361
mov dword [0x4514b4], 0
jmp case.default.0x41c361
mov dword [0x4514b4], 1
jmp case.default.0x41c361
mov dword [0x4514b4], 2
cmp dword [esp + 0x44c], 0
mov esi, 4
mov dword [esp + 0x14], esi
je 0x41c5b8
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.QuickLaunch
mov edi, 0x208
push ecx
mov dword [esp + 0x28], edi
call ebp
mov ecx, 0x442654
lea eax, [esp + 0x30]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41c404
test dx, dx
je 0x41c400
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41c404
add eax, esi
add ecx, esi
test dx, dx
jne 0x41c3e0
xor eax, eax
jmp 0x41c409
sbb eax, eax
sbb eax, 0xffffffff
xor edx, edx
test eax, eax
sete dl
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x18], edi
mov dword [0x4514c4], edx
lea edx, [esp + 0x1c]
push edx
push 0
push str.NewFeature
push eax
call ebp
mov ecx, 0x442654
lea eax, [esp + 0x30]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41c464
test dx, dx
je 0x41c460
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41c464
add eax, esi
add ecx, esi
test dx, dx
jne 0x41c440
xor eax, eax
jmp 0x41c469
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x18], edi
mov dword [0x4514cc], ecx
lea ecx, [esp + 0x1c]
push ecx
push 0
push str.RunAtonce
push edx
call ebp
mov ecx, 0x442654
lea eax, [esp + 0x30]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41c4c4
test dx, dx
je 0x41c4c0
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41c4c4
add eax, esi
add ecx, esi
test dx, dx
jne 0x41c4a0
xor eax, eax
jmp 0x41c4c9
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
lea edx, [esp + 0x10]
push edx
push 0x4514b8
lea eax, [esp + 0x1c]
push eax
push 0
mov dword [0x4514c8], ecx
mov ecx, dword [esp + 0x28]
push str.nQQGame
push ecx
mov dword [esp + 0x28], esi
call ebp
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
push 0x4514bc
lea eax, [esp + 0x1c]
push eax
push 0
push str.nQQCom
push ecx
mov dword [esp + 0x28], esi
call ebp
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
push 0x4514c0
lea eax, [esp + 0x1c]
push eax
push 0
push str.nShortcutDesktop
push ecx
mov dword [esp + 0x28], esi
call ebp
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
push 0x4514c4
lea eax, [esp + 0x1c]
push eax
push 0
push str.nShortcutQuickLaunch
push ecx
mov dword [esp + 0x28], esi
call ebp
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
push 0x4514c8
lea eax, [esp + 0x1c]
push eax
push 0
push str.nRunExe
push ecx
mov dword [esp + 0x28], esi
call ebp
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
push 0x4514cc
lea eax, [esp + 0x1c]
push eax
push 0
push str.nShowNewFeature
push ecx
mov dword [esp + 0x28], esi
call ebp
lea edx, [esp + 0x10]
push edx
push 0x4514d0
lea eax, [esp + 0x1c]
push eax
push 0
mov dword [esp + 0x20], esi
push str.nStartRunExe
jmp 0x41c5f3
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push 0x4514c0
lea eax, [esp + 0x28]
push eax
push 0
push str.nShortcutDesktop
push ecx
mov dword [esp + 0x38], esi
call ebp
lea edx, [esp + 0x14]
push edx
push 0x4514c4
lea eax, [esp + 0x28]
push eax
push 0
mov dword [esp + 0x24], esi
push str.nShortcutQuickLaunch
mov ecx, dword [esp + 0x2c]
push ecx
call ebp
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x444]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00424e88
add esp, 0x438
ret