Function at 0x411570
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474104
mov eax, dword fs:[0]
push eax
sub esp, 0x1c4
mov eax, dword [0x498068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
push 1
push str.SOFTWARETencentQQ2009
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 2
call fcn.00424ae0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4116df
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x104], esp
push 5
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], 0xf
push str.false
mov byte [ecx], bl
call fcn.004069a0
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x108], esp
push 0xc
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], 0xf
push str.NeedUnistall
mov byte [ecx], bl
call fcn.004069a0
mov byte [ebp - 4], 4
mov byte [ebp - 4], 2
call fcn.00441ad0
add esp, 0x30
cmp dword [0x49ad28], ebx
jg 0x4116bf
sub esp, 8
mov dword [ebp - 0x1d0], ebx
lea ecx, [ebp - 0x1c8]
call fcn.004235a0
mov dword [ebp - 0x12c], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
mov dword [ebp - 0x128], 0x23
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x23
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
lea ecx, [ebp - 0x1d0]
mov dword [ebp - 0x124], eax
call fcn.00426000
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c8]
mov ebx, 1
mov edx, str.HKEY_LOCAL_MACHINSOFTWARETencentQQ2009_open_fail
mov dword [ebp - 0x10c], ebx
call fcn.00407b40
mov dword [ebp - 4], 2
test bl, 1
je 0x412592
lea ecx, [ebp - 0x1d0]
call fcn.00425b00
jmp 0x412592
lea eax, [ebp - 0x58]
push eax
push str.Install
lea ecx, [ebp - 0x118]
call fcn.00424e60
test eax, eax
je 0x4117f1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x108], esp
push 5
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.false
mov byte [ecx], 0
call fcn.004069a0
sub esp, 0x18
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.NeedUnistall
mov byte [ecx], 0
call fcn.004069a0
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 2
call fcn.00441ad0
add esp, 0x30
cmp dword [0x49ad28], 0
jg 0x4117d1
sub esp, 8
mov dword [ebp - 0x1d0], 0
lea ecx, [ebp - 0x1c8]
call fcn.004235a0
mov dword [ebp - 0x12c], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
mov dword [ebp - 0x128], 0x2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x2a
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
lea ecx, [ebp - 0x1d0]
mov dword [ebp - 0x124], eax
call fcn.00426000
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1c8]
mov ebx, 2
mov edx, str.HKEY_LOCAL_MACHINSOFTWARETencentQQ2009Install_read_fail
mov dword [ebp - 0x10c], ebx
call fcn.00407b40
mov dword [ebp - 4], 2
test bl, 2
je 0x412592
lea ecx, [ebp - 0x1d0]
call fcn.00425b00
jmp 0x412592
cmp dword [ebp - 0x48], 0
jne 0x4118b8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x108], esp
push 5
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.false
mov byte [ecx], 0
call fcn.004069a0
sub esp, 0x18
mov byte [ebp - 4], 0x11
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.NeedUnistall
mov byte [ecx], 0
call fcn.004069a0
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 2
call fcn.00441ad0
add esp, 0x30
cmp dword [0x49ad28], 0
jg 0x411898
push 0
push 0x30
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
lea ecx, [ebp - 0x1d0]
call fcn.00425970
mov byte [ebp - 4], 0x13
lea ecx, [eax + 8]
mov ebx, 4
mov edx, str.install_path_empty
mov dword [ebp - 0x10c], ebx
call fcn.00407b40
mov dword [ebp - 4], 2
test bl, 4
je 0x412592
lea ecx, [ebp - 0x1d0]
call fcn.00425b00
jmp 0x412592
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xd0]
call fcn.00401920
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x18
call fcn.00401810
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call esi
cmp eax, 0xffffffff
jne 0x4119a5
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x108], esp
push 5
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.false
mov byte [ecx], 0
call fcn.004069a0
sub esp, 0x18
mov byte [ebp - 4], 0x19
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.NeedUnistall
mov byte [ecx], 0
call fcn.004069a0
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], 0x18
call fcn.00441ad0
add esp, 0x30
cmp dword [0x49ad28], 0
jg 0x411985
push 0
push 0x37
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
lea ecx, [ebp - 0x1d0]
call fcn.00425970
mov byte [ebp - 4], 0x1b
lea ecx, [eax + 8]
mov ebx, 8
mov edx, str.install_path_not_exists
mov dword [ebp - 0x10c], ebx
call fcn.00407b40
mov dword [ebp - 4], 0x18
test bl, 8
je 0x412583
lea ecx, [ebp - 0x1d0]
call fcn.00425b00
jmp 0x412583
push str.Uninstall.xml
lea ecx, [ebp - 0x28]
call fcn.004018b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x20
push eax
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0xd0]
call fcn.00427150
mov ecx, eax
mov byte [ebp - 4], 0x21
call fcn.00401810
push eax
call esi
cmp eax, 0xffffffff
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xa0]
sete byte [ebp - 0x10d]
call fcn.00401850
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x411a31
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411a27
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41263b
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 0x18
cmp byte [ebp - 0x10d], al
je 0x411f36
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x108], esp
push 5
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
push str.false
mov byte [ecx], al
call fcn.004069a0
sub esp, 0x18
mov byte [ebp - 4], 0x26
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.NeedUnistall
mov byte [ecx], 0
call fcn.004069a0
mov byte [ebp - 4], 0x27
mov byte [ebp - 4], 0x18
call fcn.00441ad0
add esp, 0x30
cmp dword [0x49ad28], 0
jg 0x411aed
push 0
push 0x3d
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
lea ecx, [ebp - 0x1d0]
call fcn.00425970
mov byte [ebp - 4], 0x28
lea ecx, [eax + 8]
mov ebx, 0x10
mov edx, str.Uninstall.xml_path_not_exists
mov dword [ebp - 0x10c], ebx
call fcn.00407b40
mov dword [ebp - 4], 0x18
test bl, 0x10
je 0x411b0d
and ebx, 0xffffffef
lea ecx, [ebp - 0x1d0]
mov dword [ebp - 0x10c], ebx
call fcn.00425b00
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
push 0x20019
push str.SoftwareTencentQQ2009
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x29
call fcn.00424ae0
test eax, eax
jne 0x412059
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x2f
push eax
push str.version
lea ecx, [ebp - 0x120]
call fcn.00424e60
test eax, eax
jne 0x411dfc
cmp dword [ebp - 0x30], eax
je 0x411dfc
mov byte [ebp - 4], 0x38
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
sub esp, 0x18
mov byte [ebp - 4], 0x39
mov ecx, esp
mov dword [ebp - 0x108], esp
push 0xd
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
push 0x4850dc
mov byte [ecx], al
call fcn.004069a0
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x39
call fcn.00442050
add esp, 0x18
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0xa0]
push eax
call fcn.00401920
push str.Uninstall.xml
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x3b
call fcn.004018b0
push str.Uninstall
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x3c
call fcn.004018b0
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x3d
push eax
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0xa0]
call fcn.00427150
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x3e
push ecx
lea ecx, [ebp - 0xe8]
push ecx
mov ecx, eax
call fcn.00427150
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x3f
push ecx
lea ecx, [ebp - 0xb8]
push ecx
mov ecx, eax
call fcn.00427150
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0x41
call fcn.00401850
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0x42
call fcn.00401850
mov byte [ebp - 4], 0x44
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x411cb3
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411ca9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412640
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
mov byte [ebp - 4], 0x49
mov edx, dword [ebp - 0x74]
cmp edx, 8
jb 0x411d08
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411cfe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412645
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x48
call fcn.00401810
push eax
call esi
cmp eax, 0xffffffff
jne 0x411e3d
cmp dword [0x49ad28], 0
jg 0x411d71
push 0
push 0x52
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
lea ecx, [ebp - 0x1d0]
call fcn.00425970
or ebx, 0x20
mov byte [ebp - 4], 0x4d
lea ecx, [eax + 8]
mov dword [ebp - 0x10c], ebx
mov edx, str.Uninstall.xml_backup_path_not_exists
call fcn.00407b40
mov dword [ebp - 4], 0x48
test bl, 0x20
je 0x411d88
lea ecx, [ebp - 0x1d0]
call fcn.00425b00
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x3b
call fcn.00401850
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x39
call fcn.00401850
mov byte [ebp - 4], 0x4e
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x411de4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411dda
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41264a
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 0x2f
mov byte [ebp - 4], 0x52
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x412041
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x412037
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41264f
jmp 0x412037
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x3b
call fcn.00401850
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x39
call fcn.00401850
mov byte [ebp - 4], 0x5a
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x411e99
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411e8f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412654
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 0x5e
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x411eeb
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411ee1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412659
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x11c]
test eax, eax
je 0x411f1f
push eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
mov dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x120]
test eax, eax
je 0x411f36
push eax
call edi
mov dword [ebp - 0x120], 0
mov byte [ebp - 4], 0x62
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x63
push eax
push str.version
lea ecx, [ebp - 0x118]
call fcn.00424e60
sub esp, 0x18
mov dword [ebp - 0x108], esp
mov ecx, esp
test eax, eax
je 0x412099
push 5
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.false
mov byte [ecx], 0
call fcn.004069a0
sub esp, 0x18
mov byte [ebp - 4], 0x64
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.NeedUnistall
mov byte [ecx], 0
call fcn.004069a0
mov byte [ebp - 4], 0x65
mov byte [ebp - 4], 0x63
call fcn.00441ad0
add esp, 0x30
cmp dword [0x49ad28], 0
jg 0x412017
push 0
push 0x5b
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
lea ecx, [ebp - 0x1d0]
call fcn.00425970
or ebx, 0x40
mov byte [ebp - 4], 0x66
lea ecx, [eax + 8]
mov dword [ebp - 0x10c], ebx
mov edx, str.HKEY_LOCAL_MACHINSOFTWARETencentQQ2009_version_read_fail
call fcn.00407b40
mov dword [ebp - 4], 0x63
test bl, 0x40
je 0x412577
lea ecx, [ebp - 0x1d0]
call fcn.00425b00
jmp 0x412577
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 0x29
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x11c]
test eax, eax
je 0x412079
push eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
mov dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x120]
test eax, eax
je 0x412583
push eax
call edi
mov dword [ebp - 0x120], 0
jmp 0x412583
cmp dword [ebp - 0x30], 0
jne 0x412155
push 5
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.false
mov byte [ecx], 0
call fcn.004069a0
sub esp, 0x18
mov byte [ebp - 4], 0x6f
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.NeedUnistall
mov byte [ecx], 0
call fcn.004069a0
mov byte [ebp - 4], 0x70
mov byte [ebp - 4], 0x63
call fcn.00441ad0
add esp, 0x30
cmp dword [0x49ad28], 0
jg 0x412136
push 0
push 0x61
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
lea ecx, [ebp - 0x1d0]
call fcn.00425970
or ebx, 0x80
mov byte [ebp - 4], 0x71
lea ecx, [eax + 8]
mov dword [ebp - 0x10c], ebx
mov edx, str.version_empty
call fcn.00407b40
mov dword [ebp - 4], 0x63
test bl, bl
jns 0x412577
lea ecx, [ebp - 0x1d0]
call fcn.00425b00
jmp 0x412577
lea eax, [ebp - 0x40]
push eax
call fcn.00401920
sub esp, 0x18
mov byte [ebp - 4], 0x7a
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0xf
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.PreviousVersion
mov byte [ecx], 0
call fcn.004069a0
mov byte [ebp - 4], 0x7b
mov byte [ebp - 4], 0x63
call fcn.00441e30
add esp, 0x30
mov byte [ebp - 4], 0x7c
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x7d
push eax
push str.rversion
lea ecx, [ebp - 0x118]
call fcn.00424e60
sub esp, 0x18
mov dword [ebp - 0x108], esp
mov ecx, esp
test eax, eax
jne 0x412222
lea eax, [ebp - 0x28]
push eax
call fcn.00401920
sub esp, 0x18
mov byte [ebp - 4], 0x7e
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0x16
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x485070
mov byte [ecx], 0
call fcn.004069a0
mov byte [ebp - 4], 0x7f
jmp 0x41225b
lea eax, [ebp - 0x40]
push eax
call fcn.00401920
sub esp, 0x18
mov byte [ebp - 4], 0x80
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0x16
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x485070
mov byte [ecx], 0
call fcn.004069a0
mov byte [ebp - 4], 0x81
mov byte [ebp - 4], 0x7d
call fcn.00441e30
add esp, 0x30
mov byte [ebp - 4], 0x82
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4122a5
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41229b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41265e
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 0x63
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x104]
push eax
push ecx
lea ecx, [ebp - 0x118]
call fcn.00424d50
test eax, eax
je 0x41239f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x108], esp
push 5
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.false
mov byte [ecx], 0
call fcn.004069a0
sub esp, 0x18
mov byte [ebp - 4], 0x86
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.NeedUnistall
mov byte [ecx], 0
call fcn.004069a0
mov byte [ebp - 4], 0x87
mov byte [ebp - 4], 0x63
call fcn.00441ad0
add esp, 0x30
cmp dword [0x49ad28], 0
jg 0x41237c
push 0
push 0x73
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
lea ecx, [ebp - 0x1d0]
call fcn.00425970
or ebx, 0x100
mov byte [ebp - 4], 0x88
lea ecx, [eax + 8]
mov dword [ebp - 0x10c], ebx
mov edx, str.HKEY_LOCAL_MACHINSOFTWARETencentQQ2009_read_fail
call fcn.00407b40
mov dword [ebp - 4], 0x63
test ebx, 0x100
je 0x412577
lea ecx, [ebp - 0x1d0]
call fcn.00425b00
jmp 0x412577
cmp dword [ebp - 0x104], 1
jne 0x4124be
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x108], esp
push 8
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x485098
mov byte [ecx], 0
call fcn.004069a0
sub esp, 0x18
mov byte [ebp - 4], 0x89
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0x13
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x4850c8
mov byte [ecx], 0
call fcn.004069a0
mov byte [ebp - 4], 0x8a
mov byte [ebp - 4], 0x63
call fcn.00441ad0
add esp, 0x18
lea eax, [ebp - 0x58]
mov ecx, esp
mov dword [ebp - 0x108], esp
push eax
call fcn.00401920
sub esp, 0x18
mov byte [ebp - 4], 0x8b
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0x13
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x4850a4
mov byte [ecx], 0
call fcn.004069a0
mov byte [ebp - 4], 0x8c
mov byte [ebp - 4], 0x63
call fcn.00441e30
add esp, 0x18
mov ecx, esp
mov dword [ebp - 0x108], esp
push 4
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.true
mov byte [ecx], 0
call fcn.004069a0
sub esp, 0x18
mov byte [ebp - 4], 0x8d
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.NeedUnistall
mov byte [ecx], 0
call fcn.004069a0
mov byte [ebp - 4], 0x8e
mov byte [ebp - 4], 0x63
call fcn.00441ad0
add esp, 0x30
mov byte [ebp - 4], 0x8f
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push 1
push str.SOFTWARETencentTIM
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x90
call fcn.00424ae0
test eax, eax
jne 0x41256b
lea eax, [ebp - 0x28]
push eax
push str.Install
lea ecx, [ebp - 0x118]
call fcn.00424e60
test eax, eax
jne 0x41256b
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
mov dword [ebp - 0x108], esp
push eax
call fcn.00401920
sub esp, 0x18
mov byte [ebp - 4], 0x91
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0xe
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.TIMInstallPath
mov byte [ecx], 0
call fcn.004069a0
mov byte [ebp - 4], 0x92
mov byte [ebp - 4], 0x90
call fcn.00441e30
add esp, 0x30
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x63
call fcn.00401850
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x18
call fcn.00401850
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 2
call fcn.00401850
mov byte [ebp - 4], 0x93
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x4125d0
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4125c6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412663
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x412606
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x118]
test eax, eax
je 0x41261d
push eax
call edi
mov dword [ebp - 0x118], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00450164
mov esp, ebp
pop ebp
ret 4
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
int3