Function at 0x414e29
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push 0x234
mov eax, 0x437952
call fcn.00433cb0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x224], ecx
call dword [sym.imp.Common.dll_public:_bool___thiscall_CTXStringW::IsEmpty_void_const]
test al, al
jne 0x4150bd
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindow]
push eax
call esi
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
jmp 0x414e81
push str.COMMERCE_QBOX
push edi
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x415002
push 2
push edi
call esi
mov edi, eax
push edi
call ebx
test eax, eax
jne 0x414e68
xor ebx, ebx
mov dword [ebp - 0x220], ebx
push 0x20019
push str.SOFTWARETencentQQQBox
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], ebx
call fcn.0041348b
mov esi, dword [ebp - 0x220]
push 0x206
lea eax, [ebp - 0x216]
push ebx
push eax
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x218], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x234]
push eax
push ebx
push str.Install
push esi
mov dword [ebp - 0x230], 0x208
mov dword [ebp - 0x234], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x220]
call fcn.00413474
mov edi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_void_]
lea ecx, [ebp - 0x21c]
call edi
lea eax, [ebp - 0x218]
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCR80.dll_wcslen]
test eax, eax
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
pop ecx
lea ecx, [ebp - 0x21c]
jne 0x41505c
mov eax, 0x104
push eax
push eax
call dword [sym.imp.Common.dll_public:_wchar_t____thiscall_CTXStringW::GetBuffer_int_]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x21c]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::ReleaseBuffer_int_]
push 0x5c
lea ecx, [ebp - 0x21c]
call dword [sym.imp.Common.dll_public:_int___thiscall_CTXStringW::ReverseFind_wchar_t_const]
inc eax
push eax
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x21c]
call dword [sym.imp.Common.dll_public:_class_CTXStringW___thiscall_CTXStringW::Left_int_]
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 2
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_class_CTXStringW_const__]
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 1
call esi
lea ecx, [ebp - 0x228]
call edi
push 6
pop edi
push ecx
lea eax, [ebp - 0x21c]
mov ecx, esp
mov dword [ebp - 0x22c], esp
push eax
mov byte [ebp - 4], 3
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
mov ecx, edi
lea edx, [ebp - 0x228]
call fcn.004143eb
lea ecx, [ebp - 0x21c]
mov dword [esp], str.QBoxHDRoom.exe
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__]
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 1
call esi
jmp 0x41507a
mov ecx, dword [ebp - 0x224]
xor ebx, ebx
mov dword [ebp - 0x240], ebx
call dword [sym.imp.Common.dll_public:_int___thiscall_CTXStringW::GetLength_void_const]
mov ecx, dword [ebp - 0x224]
mov dword [ebp - 0x23c], eax
call dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x240]
push eax
push ebx
push 0x4a
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x415053
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x4150bd
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t__]
push str.HDRoom.exe
lea ecx, [ebp - 0x21c]
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__]
mov ecx, dword [ebp - 0x224]
mov edi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push 5
push ebx
call edi
push eax
lea ecx, [ebp - 0x21c]
call edi
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], bl
call esi
lea ecx, [ebp - 0x220]
call fcn.00413474
call fcn.00433d33
ret 4