Function at 0x40a0b0
Capabilities:
Check if file exists
Create process on windows
Delete directory
Delete file
Delete registry key
Delete registry value
Get installed programs
Move file
Persist via lnk shortcut
Persist via run registry key
Query or enumerate registry value
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x459c22
mov eax, dword fs:[0]
push eax
sub esp, 0xe18
mov eax, dword [0x4724e4]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xe1c], ecx
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x674], 0
push 0x460bfa
lea ecx, [ebp - 0x560]
call fcn.00402580
mov dword [ebp - 4], 0
mov dword [ebp - 0x870], 0
push 0x9c
push 0
lea eax, [ebp - 0x86c]
push eax
call fcn.004463a0
add esp, 0xc
mov dword [ebp - 0x86c], 0x9c
lea ecx, [ebp - 0x86c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40a163
mov dword [ebp - 0x86c], 0x94
lea edx, [ebp - 0x86c]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x85c], 1
jne 0x40a17f
cmp dword [ebp - 0x868], 4
jne 0x40a17f
mov dword [ebp - 0x870], 1
mov ecx, dword [ebp - 0xe1c]
call fcn.00409980
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xe1c]
call fcn.00409b70
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x334], 0
push 0x103
push 0
lea eax, [ebp - 0x333]
push eax
call fcn.004463a0
add esp, 0xc
mov byte [ebp - 0x22c], 0
push 0x103
push 0
lea ecx, [ebp - 0x22b]
push ecx
call fcn.004463a0
add esp, 0xc
mov byte [ebp - 0x43c], 0
push 0x103
push 0
lea edx, [ebp - 0x43b]
push edx
call fcn.004463a0
add esp, 0xc
mov byte [ebp - 0x66c], 0
push 0x103
push 0
lea eax, [ebp - 0x66b]
push eax
call fcn.004463a0
add esp, 0xc
mov dword [ebp - 0x670], 0x464294
mov dword [ebp - 0x7c8], 0
lea ecx, [ebp - 0x7c8]
push ecx
push 1
push 0
mov edx, dword [ebp - 0x670]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x40a308
mov dword [ebp - 0x984], 0x104
mov dword [ebp - 0x980], 1
lea eax, [ebp - 0x984]
push eax
lea ecx, [ebp - 0x66c]
push ecx
lea edx, [ebp - 0x980]
push edx
push 0
push 0x4642c0
mov eax, dword [ebp - 0x7c8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x674], eax
lea ecx, [ebp - 0x66c]
push ecx
lea edx, [ebp - 0x334]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4642d0
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x66c]
push ecx
lea edx, [ebp - 0x43c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4642d8
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x66c]
push ecx
lea edx, [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4642f0
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x44
push 0
lea ecx, [ebp - 0x7c4]
push ecx
call fcn.004463a0
add esp, 0xc
mov dword [ebp - 0x7c4], 0x44
xor edx, edx
mov dword [ebp - 0x450], edx
mov dword [ebp - 0x44c], edx
mov dword [ebp - 0x448], edx
mov dword [ebp - 0x444], edx
mov byte [ebp - 0x55c], 0
push 0x103
push 0
lea eax, [ebp - 0x55b]
push eax
call fcn.004463a0
add esp, 0xc
mov byte [ebp - 0x124], 0
push 0x103
push 0
lea ecx, [ebp - 0x123]
push ecx
call fcn.004463a0
add esp, 0xc
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0x55c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4642f8
lea ecx, [ebp - 0x55c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x55c]
push edx
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
lea ecx, [ebp - 0x55c]
push ecx
call fcn.00443ce6
add esp, 8
cmp eax, 0xffffffff
je 0x40a44f
push str.__t__u__s
lea edx, [ebp - 0x55c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x7c4]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x55c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40a40e
jmp 0x40a44f
push 0xffffffffffffffff
mov eax, dword [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x450]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x44c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x14], 0
jne 0x40a527
mov byte [ebp - 0xa8c], 0
push 0x103
push 0
lea ecx, [ebp - 0xa8b]
push ecx
call fcn.004463a0
add esp, 0xc
lea edx, [ebp - 0x334]
push edx
lea eax, [ebp - 0xa8c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str._ngslotd.exe
lea ecx, [ebp - 0xa8c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea edx, [ebp - 0xa8c]
push edx
call fcn.00443ce6
add esp, 8
cmp eax, 0xffffffff
je 0x40a527
push 0x46432c
lea eax, [ebp - 0xa8c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x450]
push ecx
lea edx, [ebp - 0x7c4]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xa8c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40a4f3
jmp 0x40a527
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x450]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x450]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x44c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x670], 0x464330
lea ecx, [ebp - 0x7c8]
push ecx
push 0xf003f
push 0
mov edx, dword [ebp - 0x670]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x40a584
mov dword [ebp - 0x670], 0x464360
mov eax, dword [ebp - 0x670]
push eax
mov ecx, dword [ebp - 0x7c8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x670], str.SOFTWAREMicrosoftCryptographyDefaultsProvider
lea edx, [ebp - 0x7c8]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0x670]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x40a5e1
mov dword [ebp - 0x670], str.FEITIAN_ePassNG_RSA_Cryptographic_Service_Provider_For_QDCCB
mov ecx, dword [ebp - 0x670]
push ecx
mov edx, dword [ebp - 0x7c8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x670], str.SOFTWARENGSrvRef
lea eax, [ebp - 0x7c8]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp - 0x670]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x40aa1b
lea ecx, [ebp - 0xbd8]
call fcn.0040b430
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xab0]
call fcn.0040b430
mov byte [ebp - 4], 2
mov dword [ebp - 0xbc0], 0
mov byte [ebp - 0xbbc], 0
push 0x103
push 0
lea edx, [ebp - 0xbbb]
push edx
call fcn.004463a0
add esp, 0xc
mov dword [ebp - 0xa94], pe_nt_image_headers32
mov dword [ebp - 0xbdc], 4
mov dword [ebp - 0xa90], pe_nt_image_headers32
mov dword [ebp - 0xab4], 0
push 0x104
push 0
lea eax, [ebp - 0xbbc]
push eax
call fcn.004463a0
add esp, 0xc
lea ecx, [ebp - 0xa90]
push ecx
lea edx, [ebp - 0xa98]
push edx
lea eax, [ebp - 0xbdc]
push eax
push 0
lea ecx, [ebp - 0xa94]
push ecx
lea edx, [ebp - 0xbbc]
push edx
mov eax, dword [ebp - 0xbc0]
push eax
mov ecx, dword [ebp - 0x7c8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x40a757
lea edx, [ebp - 0xbbc]
push edx
lea ecx, [ebp - 0xe10]
call fcn.00402580
mov byte [ebp - 4], 3
lea eax, [ebp - 0xe10]
push eax
lea ecx, [ebp - 0xbd8]
call fcn.0040b4f0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xe10]
call fcn.00403140
lea ecx, [ebp - 0xa98]
push ecx
lea ecx, [ebp - 0xab0]
call fcn.0040b590
mov edx, dword [ebp - 0xbc0]
add edx, 1
mov dword [ebp - 0xbc0], edx
mov dword [ebp - 0xa94], pe_nt_image_headers32
mov dword [ebp - 0xa90], pe_nt_image_headers32
jmp 0x40a759
jmp 0x40a766
mov eax, 1
test eax, eax
jne 0x40a68b
mov dword [ebp - 0xbe0], 0
jmp 0x40a781
mov ecx, dword [ebp - 0xbe0]
add ecx, 1
mov dword [ebp - 0xbe0], ecx
mov edx, dword [ebp - 0xbe0]
cmp edx, dword [ebp - 0xbc0]
jae 0x40a9fd
push 0x460bfb
lea ecx, [ebp - 0xbe4]
call fcn.00402580
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xbe0]
push eax
lea ecx, [ebp - 0xbd8]
call fcn.0040b4c0
push eax
lea ecx, [ebp - 0xbe4]
call fcn.00402b90
push 0
push str.ngsrv_ngslotd.exe
lea ecx, [ebp - 0xbe4]
call fcn.00401c90
cmp eax, 0xffffffff
je 0x40a7f6
cmp dword [ebp - 0x14], 0
jne 0x40a7f6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xbe4]
call fcn.00403140
jmp 0x40a772
push 0x5c
lea ecx, [ebp - 0xbe4]
call fcn.0040b2f0
mov dword [ebp - 0x440], eax
lea ecx, [ebp - 0xbe4]
call fcn.00402c20
sub eax, dword [ebp - 0x440]
sub eax, 1
push eax
lea ecx, [ebp - 0xbe8]
push ecx
lea ecx, [ebp - 0xbe4]
call fcn.00401d10
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0xe14], esp
lea edx, [ebp - 0xbe8]
push edx
call fcn.004033a0
mov dword [ebp - 0xe20], eax
mov ecx, dword [ebp - 0xe1c]
call fcn.0040a040
mov dword [ebp - 0xe24], eax
cmp dword [ebp - 0xe24], 0
je 0x40a966
push 0x80
mov eax, dword [ebp - 0xbe0]
push eax
lea ecx, [ebp - 0xbd8]
call fcn.0040b4c0
mov ecx, eax
call fcn.00412a00
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [ebp - 0xbe0]
push ecx
lea ecx, [ebp - 0xbd8]
call fcn.0040b4c0
mov ecx, eax
call fcn.00412a00
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0xab4], eax
cmp dword [ebp - 0xab4], 0
jne 0x40a937
push 0x464414
mov edx, dword [ebp - 0xbe0]
push edx
lea ecx, [ebp - 0xbd8]
call fcn.0040b4c0
push eax
lea eax, [ebp - 0xbec]
push eax
call fcn.0040b340
add esp, 0xc
push 1
lea ecx, [ebp - 0xbec]
call fcn.00412a00
push eax
mov ecx, dword [ebp - 0xbe0]
push ecx
lea ecx, [ebp - 0xbd8]
call fcn.0040b4c0
mov ecx, eax
call fcn.00412a00
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
push 0
lea ecx, [ebp - 0xbec]
call fcn.00412a00
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [ebp - 0xbec]
call fcn.00403140
mov edx, dword [ebp - 0xbe0]
push edx
lea ecx, [ebp - 0xbd8]
call fcn.0040b4c0
mov ecx, eax
call fcn.00412a00
push eax
mov eax, dword [ebp - 0x7c8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x674], eax
jmp 0x40a9da
cmp dword [ebp - 0x10], 0
je 0x40a9da
mov ecx, dword [ebp - 0xbe0]
push ecx
lea ecx, [ebp - 0xab0]
call fcn.0040b4c0
cmp dword [eax], 1
jbe 0x40a9da
mov edx, dword [ebp - 0xbe0]
push edx
lea ecx, [ebp - 0xab0]
call fcn.0040b4c0
mov eax, dword [eax]
sub eax, 1
mov dword [ebp - 0xbf0], eax
push 4
lea ecx, [ebp - 0xbf0]
push ecx
push 4
push 0
mov edx, dword [ebp - 0xbe0]
push edx
lea ecx, [ebp - 0xbd8]
call fcn.0040b4c0
mov ecx, eax
call fcn.00412a00
push eax
mov eax, dword [ebp - 0x7c8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x674], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xbe8]
call fcn.00403140
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xbe4]
call fcn.00403140
jmp 0x40a772
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xab0]
call fcn.0040b570
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xbd8]
call fcn.0040b4a0
mov dword [ebp - 0x670], str.SOFTWARENGSrvProduct
lea ecx, [ebp - 0x7c8]
push ecx
push 0xf003f
push 0
mov edx, dword [ebp - 0x670]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x40aa78
mov dword [ebp - 0x670], str.5B337642_D80A_4a5c_889C_B6E09920F702_FT11_QDCCB
mov eax, dword [ebp - 0x670]
push eax
mov ecx, dword [ebp - 0x7c8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x14], 0
jne 0x40ab03
mov dword [ebp - 0x670], str.SOFTWARENGSrv
lea edx, [ebp - 0x7c8]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0x670]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x40ab03
mov dword [ebp - 0x670], str.Product
mov ecx, dword [ebp - 0x670]
push ecx
mov edx, dword [ebp - 0x7c8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x670], 0x464478
mov eax, dword [ebp - 0x670]
push eax
mov ecx, dword [ebp - 0x7c8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x670], str.SOFTWAREqdccb
lea edx, [ebp - 0x7c8]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0x670]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x40abeb
mov dword [ebp - 0x670], str.ePass2000_FT11
mov ecx, dword [ebp - 0x670]
push ecx
mov edx, dword [ebp - 0x7c8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x670], str.SOFTWARE
lea eax, [ebp - 0x7c8]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp - 0x670]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x40abeb
mov dword [ebp - 0x670], str.qdccb
mov edx, dword [ebp - 0x670]
push edx
mov eax, dword [ebp - 0x7c8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x14], 0
jne 0x40abeb
mov dword [ebp - 0x670], str.NGSrv
mov ecx, dword [ebp - 0x670]
push ecx
mov edx, dword [ebp - 0x7c8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x670], str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea eax, [ebp - 0x7c8]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp - 0x670]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x40ac48
mov dword [ebp - 0x670], 0x4644ec
mov edx, dword [ebp - 0x670]
push edx
mov eax, dword [ebp - 0x7c8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x14], 0
jne 0x40ac60
lea ecx, [ebp - 0x334]
push ecx
mov ecx, dword [ebp - 0xe1c]
call fcn.00409e00
lea edx, [ebp - 0x77c]
push edx
mov ecx, dword [ebp - 0xe1c]
call fcn.00408e40
mov byte [ebp - 0x97c], 0
push 0x103
push 0
lea eax, [ebp - 0x97b]
push eax
call fcn.004463a0
add esp, 0xc
lea ecx, [ebp - 0x77c]
push ecx
lea edx, [ebp - 0x97c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.qdccbePass2000_FT11FT11qdccb.dat
lea eax, [ebp - 0x97c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x97c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40acd3
lea edx, [ebp - 0x97c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
push 0
lea eax, [ebp - 0x97c]
push eax
call fcn.004463a0
add esp, 0xc
lea ecx, [ebp - 0x77c]
push ecx
lea edx, [ebp - 0x97c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.qdccbePass2000_FT11uninst.exe
lea eax, [ebp - 0x97c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x97c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40ad2d
lea edx, [ebp - 0x97c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
push 0
lea eax, [ebp - 0x97c]
push eax
call fcn.004463a0
add esp, 0xc
lea ecx, [ebp - 0x77c]
push ecx
lea edx, [ebp - 0x97c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.qdccbePass2000_FT11
lea eax, [ebp - 0x97c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x97c]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x104
push 0
lea edx, [ebp - 0x97c]
push edx
call fcn.004463a0
add esp, 0xc
lea eax, [ebp - 0x77c]
push eax
lea ecx, [ebp - 0x97c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.qdccd
lea edx, [ebp - 0x97c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x97c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [ebp - 0x670], str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [ebp - 0x7c8]
push ecx
push 0x20019
push 0
mov edx, dword [ebp - 0x670]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x40b2a1
mov byte [ebp - 0xcfc], 0
push 0x103
push 0
lea eax, [ebp - 0xcfb]
push eax
call fcn.004463a0
add esp, 0xc
mov dword [ebp - 0xd00], 0x104
lea ecx, [ebp - 0xd00]
push ecx
lea edx, [ebp - 0xcfc]
push edx
push 0
push 0
push str.Common_Programs
mov eax, dword [ebp - 0x7c8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x40b29f
mov byte [ebp - 0xe0c], 0
push 0x103
push 0
lea ecx, [ebp - 0xe0b]
push ecx
call fcn.004463a0
add esp, 0xc
mov edx, dword [ebp - 0xd00]
push edx
lea eax, [ebp - 0xcfc]
push eax
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.00448140
add esp, 0xc
push str.Feitian_
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40aec4
lea ecx, [ebp - 0xe0c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
push 0
lea edx, [ebp - 0xe0c]
push edx
call fcn.004463a0
add esp, 0xc
mov eax, dword [ebp - 0xd00]
push eax
lea ecx, [ebp - 0xcfc]
push ecx
lea edx, [ebp - 0xe0c]
push edx
call fcn.00448140
add esp, 0xc
push 0x46461c
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0xe0c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40af27
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
push 0
lea eax, [ebp - 0xe0c]
push eax
call fcn.004463a0
add esp, 0xc
mov ecx, dword [ebp - 0xd00]
push ecx
lea edx, [ebp - 0xcfc]
push edx
lea eax, [ebp - 0xe0c]
push eax
call fcn.00448140
add esp, 0xc
push 0x464648
lea ecx, [ebp - 0xe0c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40af8a
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
push 0
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.004463a0
add esp, 0xc
mov edx, dword [ebp - 0xd00]
push edx
lea eax, [ebp - 0xcfc]
push eax
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.00448140
add esp, 0xc
push str.The_Certificate_Manager_for_QDCCBQDCCB_UKey_DriverUninstallQDCCB_UKey_Driver.lnk
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40afed
lea ecx, [ebp - 0xe0c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
push 0
lea edx, [ebp - 0xe0c]
push edx
call fcn.004463a0
add esp, 0xc
mov eax, dword [ebp - 0xd00]
push eax
lea ecx, [ebp - 0xcfc]
push ecx
lea edx, [ebp - 0xe0c]
push edx
call fcn.00448140
add esp, 0xc
push str.FeitianQDCCB_UKey_DriverUninstallQDCCB_UKey_Driver.lnk
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0xe0c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40b050
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
push 0
lea eax, [ebp - 0xe0c]
push eax
call fcn.004463a0
add esp, 0xc
mov ecx, dword [ebp - 0xd00]
push ecx
lea edx, [ebp - 0xcfc]
push edx
lea eax, [ebp - 0xe0c]
push eax
call fcn.00448140
add esp, 0xc
push str.FeitianePass2000UninstallePass2000.lnk
lea ecx, [ebp - 0xe0c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40b0b3
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
push 0
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.004463a0
add esp, 0xc
mov edx, dword [ebp - 0xd00]
push edx
lea eax, [ebp - 0xcfc]
push eax
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.00448140
add esp, 0xc
push 0x464750
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x104
push 0
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.004463a0
add esp, 0xc
mov edx, dword [ebp - 0xd00]
push edx
lea eax, [ebp - 0xcfc]
push eax
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.00448140
add esp, 0xc
push 0x464784
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x104
push 0
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.004463a0
add esp, 0xc
mov edx, dword [ebp - 0xd00]
push edx
lea eax, [ebp - 0xcfc]
push eax
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.00448140
add esp, 0xc
push 0x4647b4
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x104
push 0
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.004463a0
add esp, 0xc
mov edx, dword [ebp - 0xd00]
push edx
lea eax, [ebp - 0xcfc]
push eax
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.00448140
add esp, 0xc
push str.FeitianePass2000
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x104
push 0
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.004463a0
add esp, 0xc
mov edx, dword [ebp - 0xd00]
push edx
lea eax, [ebp - 0xcfc]
push eax
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.00448140
add esp, 0xc
push str.FeitianQDCCB_UKey_Driver
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x104
push 0
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.004463a0
add esp, 0xc
mov edx, dword [ebp - 0xd00]
push edx
lea eax, [ebp - 0xcfc]
push eax
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.00448140
add esp, 0xc
push str.Feitian
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x40b2ae
mov ecx, dword [ebp - 0x7c8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xe18], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x560]
call fcn.00403140
mov eax, dword [ebp - 0xe18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00441f6e
mov esp, ebp
pop ebp
ret