Function at 0x4134b0
Capabilities:
Contain obfuscated stackstrings
Delete registry key
Get common file path
Get startup folder
Move file
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473fe1
mov eax, dword fs:[0]
push eax
sub esp, 0xb54
mov eax, dword [0x498068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0xb60], esi
xor ebx, ebx
lea ecx, [ebp - 0xaa8]
mov dword [ebp - 0xaa4], ebx
mov dword [ebp - 0xaa8], ebx
call fcn.00403e40
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x49ad2c], ebx
jg 0x41357d
sub esp, 8
mov dword [ebp - 0xb58], ebx
lea ecx, [ebp - 0xb50]
call fcn.00422bb0
mov dword [ebp - 0xab4], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab0], 0x9a
call edi
push 0x9a
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaac], eax
call fcn.00425610
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0xb50]
push dword [ebp - 0xaa8]
mov ebx, 1
mov edx, str.doDeleteQPFiles____product_count:
mov dword [ebp - 0xaa4], ebx
call fcn.00407130
mov ecx, eax
call fcn.004050f0
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x41359d
and ebx, 0xfffffffe
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaa4], ebx
call fcn.00425110
push esi
lea ecx, [ebp - 0x9e0]
call fcn.00401920
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x878]
push 0xd
xor eax, eax
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x864], 0
push str.BinQQProtect
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x864], 7
mov word [ebp - 0x878], ax
call fcn.00401a50
lea eax, [ebp - 0x878]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x9e0]
call fcn.00426760
lea ecx, [ebp - 0x9e0]
mov byte [ebp - 4], 3
cmp ecx, eax
je 0x413637
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x413628
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x9e0]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 2
call fcn.00401850
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x864]
cmp edx, 8
jb 0x41368a
mov ecx, dword [ebp - 0x878]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x413680
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416549
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x864], 7
mov word [ebp - 0x878], ax
mov dl, 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x9e0]
call fcn.004274b0
mov byte [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x8f8], 0
mov dword [ebp - 0x8f4], 0
mov dword [ebp - 0x8f8], 0
mov dword [ebp - 0x8f4], 7
mov word [ebp - 0x908], ax
push 0x208
push eax
lea eax, [ebp - 0x830]
mov byte [ebp - 4], 9
push eax
call fcn.00452050
add esp, 0xc
lea eax, [ebp - 0x830]
push 0
push 0x2b
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x830]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413722
sub ecx, edx
lea eax, [ebp - 0x830]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x908]
call fcn.00401a50
lea eax, [ebp - 0x908]
push eax
lea ecx, [ebp - 0x938]
call fcn.00401920
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x890]
push 9
xor eax, eax
mov dword [ebp - 0x880], 0
mov dword [ebp - 0x87c], 0
push str.QQProtect
mov dword [ebp - 0x880], 0
mov dword [ebp - 0x87c], 7
mov word [ebp - 0x890], ax
call fcn.00401a50
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x878]
push 7
xor eax, eax
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x864], 0
push 0x484908
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x864], 7
mov word [ebp - 0x878], ax
call fcn.00401a50
lea eax, [ebp - 0x878]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0xa28]
push eax
lea ecx, [ebp - 0x938]
call fcn.00426760
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], 0xd
push ecx
lea ecx, [ebp - 0x8a8]
push ecx
mov ecx, eax
call fcn.00426760
lea ecx, [ebp - 0x938]
mov byte [ebp - 4], 0xe
cmp ecx, eax
je 0x413841
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x413832
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x938]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0xd
call fcn.00401850
lea ecx, [ebp - 0xa28]
mov byte [ebp - 4], 0xc
call fcn.00401850
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x864]
cmp edx, 8
jb 0x4138a3
mov ecx, dword [ebp - 0x878]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x413899
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41654e
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x864], 7
mov word [ebp - 0x878], ax
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x87c]
cmp edx, 8
jb 0x413904
mov ecx, dword [ebp - 0x890]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4138fa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416553
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x880], 0
mov dword [ebp - 0x87c], 7
mov word [ebp - 0x890], ax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x860]
push 0x11
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], eax
push str.BinQQProtect.exe
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
call fcn.00401a50
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x9c8]
push eax
lea ecx, [ebp - 0x938]
call fcn.00426760
mov byte [ebp - 4], 0x1a
mov edx, dword [ebp - 0x84c]
cmp edx, 8
jb 0x4139bb
mov ecx, dword [ebp - 0x860]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4139b1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416558
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
mov byte [ebp - 4], 0x19
call fcn.00412cb0
cmp dword [0x49ad2c], 0
mov esi, eax
jg 0x413a5a
sub esp, 8
mov dword [ebp - 0xb58], 0
lea ecx, [ebp - 0xb50]
call fcn.00422bb0
mov dword [ebp - 0xab4], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab0], 0xb3
call edi
push 0xb3
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaac], eax
call fcn.00425610
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xb50]
or ebx, 2
mov edx, str.remove_qpcore:
push esi
mov dword [ebp - 0xaa4], ebx
call fcn.00407130
mov ecx, eax
call fcn.004050f0
mov dword [ebp - 4], 0x19
test bl, 2
je 0x413a7a
and ebx, 0xfffffffd
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaa4], ebx
call fcn.00425110
lea eax, [ebp - 0x9c8]
push eax
lea ecx, [ebp - 0x848]
call fcn.00428d80
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x860]
push 2
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
push 0x484950
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0xf
mov byte [ebp - 0x860], 0
call fcn.00405f80
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0x20
push eax
lea ecx, [ebp - 0x848]
call fcn.00429940
mov byte [ebp - 4], 0x21
mov edx, dword [ebp - 0x84c]
cmp edx, 0x10
jb 0x413b25
mov ecx, dword [ebp - 0x860]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x413b1b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41655d
push edx
push ecx
call fcn.0044f7c7
add esp, 8
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0xf
mov byte [ebp - 0x860], 0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x890]
push 9
mov dword [ebp - 0x880], 0
mov dword [ebp - 0x87c], 0
push str._utqpcore
mov dword [ebp - 0x880], 0
mov dword [ebp - 0x87c], 0xf
mov byte [ebp - 0x890], 0
call fcn.00405f80
lea eax, [ebp - 0x890]
mov byte [ebp - 4], 0x25
push eax
lea ecx, [ebp - 0x848]
call fcn.00429940
mov byte [ebp - 4], 0x26
mov edx, dword [ebp - 0x87c]
cmp edx, 0x10
jb 0x413bd9
mov ecx, dword [ebp - 0x890]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x413bcf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416562
push edx
push ecx
call fcn.0044f7c7
add esp, 8
mov dword [ebp - 0x880], 0
mov dword [ebp - 0x87c], 0xf
mov byte [ebp - 0x890], 0
mov byte [ebp - 4], 0x1f
cmp dword [0x49ad2c], 2
jg 0x413c83
sub esp, 8
mov dword [ebp - 0xb58], 2
lea ecx, [ebp - 0xb50]
call fcn.00422bb0
mov dword [ebp - 0xab4], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab0], 0xba
call edi
push 0xba
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaac], eax
call fcn.00425610
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xb50]
or ebx, 4
mov edx, str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
push 0xba
mov dword [ebp - 0xaa4], ebx
call fcn.00407130
mov ecx, eax
call fcn.00405430
mov edx, str._utqpcore__3
mov ecx, eax
call fcn.00407130
mov dword [ebp - 4], 0x1f
test bl, 4
je 0x413ca3
and ebx, 0xfffffffb
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaa4], ebx
call fcn.00425110
cmp dword [0x49ad2c], 0
jg 0x413d3d
sub esp, 8
mov dword [ebp - 0xb58], 0
lea ecx, [ebp - 0xb50]
call fcn.00422bb0
mov dword [ebp - 0xab4], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab0], 0xbb
call edi
push 0xbb
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaac], eax
call fcn.00425610
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0xb50]
or ebx, 8
mov edx, str.UnInstall_
mov dword [ebp - 0xaa4], ebx
call fcn.00407130
cmp dword [ebp - 0x9b4], 8
lea edx, [ebp - 0x9c8]
mov ecx, eax
cmovae edx, dword [ebp - 0x9c8]
call fcn.00425a00
mov edx, 0x4878c4
mov ecx, eax
call fcn.00407130
mov dword [ebp - 4], 0x1f
test bl, 8
je 0x413d5d
and ebx, 0xfffffff7
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaa4], ebx
call fcn.00425110
lea eax, [ebp - 0xaa8]
mov dword [ebp - 0xb5c], 0
push eax
lea edx, [ebp - 0x870]
mov word [ebp - 0x86f], 0
lea ecx, [ebp - 0x848]
mov dword [ebp - 0x86c], 0
mov byte [ebp - 0x868], 0
mov dword [ebp - 0x864], 0
mov byte [ebp - 0x870], 1
mov dword [ebp - 0xaa8], 0
call fcn.00423bf0
add esp, 4
test al, al
je 0x413f18
mov esi, dword [ebp - 0xaa8]
push 0xea60
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x413e6f
cmp dword [0x49ad2c], 2
jg 0x413e57
sub esp, 8
mov dword [ebp - 0xb58], 2
lea ecx, [ebp - 0xb50]
call fcn.00422bb0
mov dword [ebp - 0xab4], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab0], 0xc3
call edi
push 0xc3
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaac], eax
call fcn.00425610
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0xb50]
or ebx, 0x10
push 0xc3
mov dword [ebp - 0xaa4], ebx
call fcn.00405430
mov edx, str.wait_qqprotect_exit_timeout_
mov ecx, eax
call fcn.00407130
mov dword [ebp - 4], 0x1f
test bl, 0x10
je 0x413f18
and ebx, 0xffffffef
jmp 0x413f07
lea edx, [ebp - 0xb5c]
mov ecx, esi
call fcn.00423c90
cmp dword [0x49ad2c], 0
jg 0x413ef8
sub esp, 8
mov dword [ebp - 0xb58], 0
lea ecx, [ebp - 0xb50]
call fcn.00422bb0
mov dword [ebp - 0xab4], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab0], 0xc6
call edi
push 0xc6
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaac], eax
call fcn.00425610
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0xb50]
push dword [ebp - 0xb5c]
or ebx, 0x20
mov edx, str._3__utqpcore:
mov dword [ebp - 0xaa4], ebx
call fcn.00407130
mov ecx, eax
call fcn.00405430
mov dword [ebp - 4], 0x1f
test bl, 0x20
je 0x413f18
and ebx, 0xffffffdf
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaa4], ebx
call fcn.00425110
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x83c]
mov esi, dword [ebp - 0x83c]
push dword [esi + 4]
call fcn.00429d10
mov eax, dword [ebp - 0x83c]
push 0x40
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x83c]
mov dword [eax], esi
mov eax, dword [ebp - 0x83c]
mov dword [eax + 8], esi
push dword [ebp - 0x83c]
mov dword [ebp - 0x838], 0
call fcn.0044f7c7
add esp, 8
lea ecx, [ebp - 0x848]
call fcn.004192b0
mov dl, 1
lea ecx, [ebp - 0x938]
call fcn.004274b0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00452050
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp dword [0x49ad1c], 1
jne 0x414023
cmp dword [0x49ad2c], 3
jg 0x414023
test eax, eax
je 0x414023
sub esp, 8
mov dword [ebp - 0xb58], 3
lea ecx, [ebp - 0xb50]
call fcn.00422bb0
mov dword [ebp - 0xab4], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab0], 0xd2
call edi
push 0xd2
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaac], eax
call fcn.00425610
or ebx, 0x40
mov byte [ebp - 4], 0x2e
mov edx, str.Check_failed:_hr__S_OK.
mov dword [ebp - 0xaa4], ebx
lea ecx, [ebp - 0xb50]
call fcn.00407130
mov dword [ebp - 4], 0x19
test bl, 0x40
je 0x414043
and ebx, 0xffffffbf
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaa4], ebx
call fcn.00425110
xor eax, eax
mov dword [ebp - 0x838], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x838], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414080
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x848]
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0x2f
push eax
lea ecx, [ebp - 0x9b0]
call fcn.00401920
mov byte [ebp - 4], 0x32
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x4140fc
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4140f2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416567
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x860]
push 0x17
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], eax
push str.TencentQQProtectQScan
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
call fcn.00401a50
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0x36
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x9b0]
call fcn.00426760
lea ecx, [ebp - 0x9b0]
mov byte [ebp - 4], 0x37
cmp ecx, eax
je 0x414196
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x414187
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x9b0]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x36
call fcn.00401850
mov byte [ebp - 4], 0x38
mov edx, dword [ebp - 0x84c]
cmp edx, 8
jb 0x4141e9
mov ecx, dword [ebp - 0x860]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4141df
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41656c
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
mov byte [ebp - 4], 0x31
xor esi, esi
mov dword [ebp - 0x870], str.QScanEngine.dll
mov dword [ebp - 0x86c], str.config.dat
mov dword [ebp - 0x868], str.sig.dat
mov dword [ebp - 0x864], str.QSLSig.dat
nop dword [eax]
nop dword [eax + eax]
lea eax, [ebp - 0x9b0]
push eax
lea ecx, [ebp - 0x8d8]
call fcn.00401920
mov byte [ebp - 4], 0x3c
xor eax, eax
mov edx, dword [ebp + esi*4 - 0x870]
mov ecx, edx
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
lea edi, [ecx + 2]
mov word [ebp - 0x848], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414293
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x848]
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0x3d
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x8d8]
call fcn.00426760
lea ecx, [ebp - 0x8d8]
mov byte [ebp - 4], 0x3e
cmp ecx, eax
je 0x4142f3
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x4142e4
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x8d8]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x3d
call fcn.00401850
mov byte [ebp - 4], 0x3f
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x414346
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41433c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416549
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
xor dl, dl
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x8d8]
call fcn.004274b0
lea ecx, [ebp - 0x8d8]
mov byte [ebp - 4], 0x31
call fcn.00401850
inc esi
cmp esi, 4
jb 0x414240
mov esi, dword [ebp - 0xb60]
lea ecx, [ebp - 0x8d8]
push esi
call fcn.00401920
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x848]
push 3
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
push 0x4862bc
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0x44
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x8d8]
call fcn.00426760
lea ecx, [ebp - 0x8d8]
mov byte [ebp - 4], 0x45
cmp ecx, eax
je 0x41442a
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x41441b
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x8d8]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x44
call fcn.00401850
mov byte [ebp - 4], 0x46
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x41447d
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414473
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416571
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
lea eax, [ebp - 0x8d8]
mov byte [ebp - 4], 0x43
push eax
lea ecx, [ebp - 0x998]
call fcn.00401920
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0x860]
push 0xf
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
push str.QScanEngine.dll
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
call fcn.00401a50
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0x4b
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x998]
call fcn.00426760
lea ecx, [ebp - 0x998]
mov byte [ebp - 4], 0x4c
cmp ecx, eax
je 0x41453b
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x41452c
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x998]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x4b
call fcn.00401850
mov byte [ebp - 4], 0x4d
mov edx, dword [ebp - 0x84c]
cmp edx, 8
jb 0x41458e
mov ecx, dword [ebp - 0x860]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414584
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416576
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
xor dl, dl
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0x998]
call fcn.004274b0
lea eax, [ebp - 0x8d8]
push eax
lea ecx, [ebp - 0x980]
call fcn.00401920
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x848]
push 0xb
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
push str.QSLogic.dll
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0x52
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x980]
call fcn.00426760
lea ecx, [ebp - 0x980]
mov byte [ebp - 4], 0x53
cmp ecx, eax
je 0x414659
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x41464a
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x980]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x52
call fcn.00401850
mov byte [ebp - 4], 0x54
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x4146ac
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4146a2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41657b
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
xor dl, dl
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x980]
call fcn.004274b0
push esi
lea ecx, [ebp - 0x920]
call fcn.00401920
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x860]
push 4
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
push str.Misc
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
call fcn.00401a50
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0x59
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x920]
call fcn.00426760
lea ecx, [ebp - 0x920]
mov byte [ebp - 4], 0x5a
cmp ecx, eax
je 0x414771
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x414762
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x920]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x59
call fcn.00401850
mov byte [ebp - 4], 0x5b
mov edx, dword [ebp - 0x84c]
cmp edx, 8
jb 0x4147c4
mov ecx, dword [ebp - 0x860]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4147ba
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416580
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
lea eax, [ebp - 0x920]
mov byte [ebp - 4], 0x58
push eax
lea ecx, [ebp - 0x8f0]
call fcn.00401920
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x848]
push 5
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
push str.QScan
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0x60
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x8f0]
call fcn.00426760
lea ecx, [ebp - 0x8f0]
mov byte [ebp - 4], 0x61
cmp ecx, eax
je 0x414882
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x414873
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x8f0]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x60
call fcn.00401850
mov byte [ebp - 4], 0x62
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x4148d5
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4148cb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416585
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
lea eax, [ebp - 0x8f0]
mov byte [ebp - 4], 0x5f
push eax
lea ecx, [ebp - 0x968]
call fcn.00401920
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x860]
push 0xa
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
push str.config.dat
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
call fcn.00401a50
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0x67
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x968]
call fcn.00426760
lea ecx, [ebp - 0x968]
mov byte [ebp - 4], 0x68
cmp ecx, eax
je 0x414993
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x414984
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x968]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x67
call fcn.00401850
mov byte [ebp - 4], 0x69
mov edx, dword [ebp - 0x84c]
cmp edx, 8
jb 0x4149e6
mov ecx, dword [ebp - 0x860]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4149dc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41658a
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
xor dl, dl
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x968]
call fcn.004274b0
lea eax, [ebp - 0x8f0]
push eax
lea ecx, [ebp - 0x950]
call fcn.00401920
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x848]
push 7
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
push str.sig.dat
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0x6e
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x950]
call fcn.00426760
lea ecx, [ebp - 0x950]
mov byte [ebp - 4], 0x6f
cmp ecx, eax
je 0x414ab1
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x414aa2
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x950]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x6e
call fcn.00401850
mov byte [ebp - 4], 0x70
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x414b04
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414afa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41658f
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
xor dl, dl
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x950]
call fcn.004274b0
lea eax, [ebp - 0x8f0]
push eax
lea ecx, [ebp - 0x9f8]
call fcn.00401920
mov byte [ebp - 4], 0x74
lea ecx, [ebp - 0x860]
push 0xa
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
push str.QSLSig.dat
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
call fcn.00401a50
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0x75
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x9f8]
call fcn.00426760
lea ecx, [ebp - 0x9f8]
mov byte [ebp - 4], 0x76
cmp ecx, eax
je 0x414bcf
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x414bc0
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x9f8]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x75
call fcn.00401850
mov byte [ebp - 4], 0x77
mov edx, dword [ebp - 0x84c]
cmp edx, 8
jb 0x414c22
mov ecx, dword [ebp - 0x860]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414c18
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416594
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
xor dl, dl
mov byte [ebp - 4], 0x74
lea ecx, [ebp - 0x9f8]
call fcn.004274b0
xor dl, dl
lea ecx, [ebp - 0x8f0]
call fcn.004274b0
xor dl, dl
lea ecx, [ebp - 0x920]
call fcn.004274b0
push 0x18
xor eax, eax
mov dword [ebp - 0x880], 0
mov dword [ebp - 0x87c], 0
lea ecx, [ebp - 0x890]
push str.TencentQQProtectAuTemp
mov dword [ebp - 0x880], 0
mov dword [ebp - 0x87c], 7
mov word [ebp - 0x890], ax
call fcn.00401a50
mov byte [ebp - 4], 0x7b
lea ecx, [ebp - 0x218]
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414cf0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x848]
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0x7c
push eax
lea ecx, [ebp - 0x8c0]
call fcn.00401920
lea eax, [ebp - 0x890]
mov byte [ebp - 4], 0x7d
push eax
lea eax, [ebp - 0xaa0]
push eax
lea ecx, [ebp - 0x8c0]
call fcn.00426760
lea ecx, [ebp - 0x8c0]
mov byte [ebp - 4], 0x7f
call fcn.00401850
mov byte [ebp - 4], 0x81
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x414d98
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414d8e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416599
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
mov byte [ebp - 4], 0x86
mov edx, dword [ebp - 0x87c]
cmp edx, 8
jb 0x414df9
mov ecx, dword [ebp - 0x890]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414def
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41659e
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x880], 0
mov dword [ebp - 0x87c], 7
mov word [ebp - 0x890], ax
mov dl, 1
mov byte [ebp - 4], 0x85
lea ecx, [ebp - 0xaa0]
call fcn.004274b0
push 0x19
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
lea ecx, [ebp - 0x860]
push str.TencentQQProtect_atf.dat
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
call fcn.00401a50
mov byte [ebp - 4], 0x8a
lea ecx, [ebp - 0x218]
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414eb0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x848]
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0x8b
push eax
lea ecx, [ebp - 0x8c0]
call fcn.00401920
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0x8c
push eax
lea eax, [ebp - 0xa88]
push eax
lea ecx, [ebp - 0x8c0]
call fcn.00426760
lea ecx, [ebp - 0x8c0]
mov byte [ebp - 4], 0x8e
call fcn.00401850
mov byte [ebp - 4], 0x90
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x414f58
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414f4e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4165a3
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
mov byte [ebp - 4], 0x95
mov edx, dword [ebp - 0x84c]
cmp edx, 8
jb 0x414fb9
mov ecx, dword [ebp - 0x860]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414faf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4165a8
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
xor dl, dl
mov byte [ebp - 4], 0x94
lea ecx, [ebp - 0xa88]
call fcn.004274b0
lea ecx, [ebp - 0xa10]
call fcn.00401900
mov byte [ebp - 4], 0x99
cmp dword [0x49bae4], 0
jne 0x415033
push 0x28
call fcn.0044f797
add esp, 4
mov ecx, eax
call fcn.00424770
push 0
mov esi, eax
push esi
push 0x49bae4
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x415033
test esi, esi
je 0x415033
push 0x28
push esi
call fcn.0044f7c7
add esp, 8
mov eax, dword [0x49bae4]
cmp dword [eax + 0x24], 1
jne 0x41544c
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00452050
add esp, 0xc
lea eax, [ebp - 0x628]
push 0
push 0x25
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x415397
xor eax, eax
mov dword [ebp - 0x838], 0
lea ecx, [ebp - 0x628]
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x838], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4150b3
sub ecx, edx
lea eax, [ebp - 0x628]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x848]
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0x9a
push eax
lea ecx, [ebp - 0x860]
call fcn.00401920
lea eax, [ebp - 0x8a8]
mov byte [ebp - 4], 0x9b
push eax
lea ecx, [ebp - 0x860]
call fcn.00426a40
push eax
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], 0x9c
call fcn.00401920
lea ecx, [ebp - 0x890]
call fcn.00426940
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x9e
call fcn.00401850
lea ecx, [ebp - 0x860]
mov byte [ebp - 4], 0x9f
call fcn.00401850
mov byte [ebp - 4], 0xa1
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x41517e
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415174
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4165ad
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
mov byte [ebp - 4], 0xa0
lea ecx, [ebp - 0x860]
push 0x18
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], eax
push str.driversQQProtectX64.sys
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
call fcn.00401a50
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0xa5
push eax
lea eax, [ebp - 0x8c0]
push eax
lea ecx, [ebp - 0x890]
call fcn.00426760
mov byte [ebp - 4], 0xa8
mov edx, dword [ebp - 0x84c]
cmp edx, 8
jb 0x415235
mov ecx, dword [ebp - 0x860]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41522b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4165b2
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
mov byte [ebp - 4], 0xa7
mov eax, dword [0x49aca8]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x415281
push str.kernel32.dll
call esi
push str.Wow64EnableWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49aca8], eax
test eax, eax
je 0x415285
push 0
call eax
xor dl, dl
lea ecx, [ebp - 0x8c0]
call fcn.004274b0
test al, al
jne 0x415350
cmp dword [0x49ad2c], 0
jg 0x415310
sub esp, 8
mov dword [ebp - 0xb58], 0
lea ecx, [ebp - 0xb50]
call fcn.00422bb0
mov dword [ebp - 0xab4], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab0], 0x119
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x119
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaac], eax
call fcn.00425610
or ebx, 0x80
mov byte [ebp - 4], 0xac
mov edx, str.delete_qqprotectx64.sys_after_reboot_
mov dword [ebp - 0xaa4], ebx
lea ecx, [ebp - 0xb50]
call fcn.00407130
mov dword [ebp - 4], 0xa7
test bl, bl
jns 0x415332
and ebx, 0xffffff7f
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaa4], ebx
call fcn.00425110
lea ecx, [ebp - 0x8c0]
call fcn.00405f50
cmp eax, 0x104
jae 0x415350
push 5
push 0
call fcn.00401810
push eax
call edi
mov eax, dword [0x49aca8]
test eax, eax
jne 0x415375
push str.kernel32.dll
call esi
push str.Wow64EnableWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49aca8], eax
test eax, eax
je 0x415379
push 1
call eax
lea ecx, [ebp - 0x8c0]
mov byte [ebp - 4], 0xa0
call fcn.00401850
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], 0x99
call fcn.00401850
push str.SYSTEMCurrentControlSetServicesQQProtectX64
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [0x49ad2c], 0
jg 0x41541d
sub esp, 8
mov dword [ebp - 0xb58], 0
lea ecx, [ebp - 0xb50]
call fcn.00422bb0
mov dword [ebp - 0xab4], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab0], 0x120
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x120
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaac], eax
call fcn.00425610
or ebx, 0x100
mov byte [ebp - 4], 0xad
mov edx, str.deleted:_SYSTEMCurrentControlSetServicesQQProtectX64
mov dword [ebp - 0xaa4], ebx
lea ecx, [ebp - 0xb50]
call fcn.00407130
mov dword [ebp - 4], 0x99
test ebx, 0x100
je 0x4158fe
and ebx, 0xfffffeff
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaa4], ebx
call fcn.00425110
jmp 0x4158fe
lea edx, [ebp - 0xa10]
mov ecx, 0x66
call fcn.0042b6d0
push 0x15
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
lea ecx, [ebp - 0x848]
push str.driversQQProtect.sys
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0xae
push eax
lea eax, [ebp - 0x860]
push eax
lea ecx, [ebp - 0xa10]
call fcn.00426760
mov byte [ebp - 4], 0xb1
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x415500
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4154f6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4165b7
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
xor dl, dl
mov byte [ebp - 4], 0xb0
lea ecx, [ebp - 0x860]
call fcn.004274b0
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
test al, al
jne 0x4155f6
cmp dword [0x49ad2c], 0
jg 0x4155b2
sub esp, 8
mov dword [ebp - 0xb58], 0
lea ecx, [ebp - 0xb50]
call fcn.00422bb0
mov dword [ebp - 0xab4], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab0], 0x128
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x128
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaac], eax
call fcn.00425610
or ebx, 0x200
mov byte [ebp - 4], 0xb5
mov edx, str.delete_qqprotect.sys_after_reboot_
mov dword [ebp - 0xaa4], ebx
lea ecx, [ebp - 0xb50]
call fcn.00407130
mov dword [ebp - 4], 0xb0
test ebx, 0x200
je 0x4155d8
and ebx, 0xfffffdff
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaa4], ebx
call fcn.00425110
lea ecx, [ebp - 0x860]
call fcn.00405f50
cmp eax, 0x104
jae 0x4155f6
push 5
push 0
call fcn.00401810
push eax
call edi
push 0x14
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
lea ecx, [ebp - 0x848]
push str.driversQQFrmMgr.sys
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0xb6
push eax
lea eax, [ebp - 0x8c0]
push eax
lea ecx, [ebp - 0xa10]
call fcn.00426760
mov byte [ebp - 4], 0xb9
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x41569a
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415690
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4165bc
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
xor dl, dl
mov byte [ebp - 4], 0xb8
lea ecx, [ebp - 0x8c0]
call fcn.004274b0
test al, al
jne 0x41578a
cmp dword [0x49ad2c], 0
jg 0x415746
sub esp, 8
mov dword [ebp - 0xb58], 0
lea ecx, [ebp - 0xb50]
call fcn.00422bb0
mov dword [ebp - 0xab4], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab0], 0x12e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x12e
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaac], eax
call fcn.00425610
or ebx, 0x400
mov byte [ebp - 4], 0xbd
mov edx, str.delete_qqfrmmgr.sys_after_reboot_
mov dword [ebp - 0xaa4], ebx
lea ecx, [ebp - 0xb50]
call fcn.00407130
mov dword [ebp - 4], 0xb8
test ebx, 0x400
je 0x41576c
and ebx, 0xfffffbff
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaa4], ebx
call fcn.00425110
lea ecx, [ebp - 0x8c0]
call fcn.00405f50
cmp eax, 0x104
jae 0x41578a
push 5
push 0
call fcn.00401810
push eax
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.SYSTEMCurrentControlSetServicesQQProtect
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp dword [0x49ad2c], 0
jg 0x415812
sub esp, 8
mov dword [ebp - 0xb58], 0
lea ecx, [ebp - 0xb50]
call fcn.00422bb0
mov dword [ebp - 0xab4], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab0], 0x133
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x133
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaac], eax
call fcn.00425610
or ebx, 0x800
mov byte [ebp - 4], 0xbe
mov edx, str.deleted:_SYSTEMCurrentControlSetServicesQQProtect
mov dword [ebp - 0xaa4], ebx
lea ecx, [ebp - 0xb50]
call fcn.00407130
mov dword [ebp - 4], 0xb8
test ebx, 0x800
je 0x415838
and ebx, 0xfffff7ff
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaa4], ebx
call fcn.00425110
push str.SYSTEMCurrentControlSetServicesQQFrmMgr
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp dword [0x49ad2c], 0
jg 0x4158ba
sub esp, 8
mov dword [ebp - 0xb58], 0
lea ecx, [ebp - 0xb50]
call fcn.00422bb0
mov dword [ebp - 0xab4], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab0], 0x136
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x136
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaac], eax
call fcn.00425610
or ebx, 0x1000
mov byte [ebp - 4], 0xbf
mov edx, str.deleted:_SYSTEMCurrentControlSetServicesQQFrmMgr
mov dword [ebp - 0xaa4], ebx
lea ecx, [ebp - 0xb50]
call fcn.00407130
mov dword [ebp - 4], 0xb8
test ebx, 0x1000
je 0x4158e0
and ebx, 0xffffefff
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaa4], ebx
call fcn.00425110
lea ecx, [ebp - 0x8c0]
mov byte [ebp - 4], 0xb0
call fcn.00401850
lea ecx, [ebp - 0x860]
mov byte [ebp - 4], 0x99
call fcn.00401850
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00452050
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [ebp - 0x838], 0
lea ecx, [ebp - 0x420]
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x838], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415963
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x848]
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0xc0
push eax
lea ecx, [ebp - 0x8c0]
call fcn.00401920
mov byte [ebp - 4], 0xc3
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x4159df
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4159d5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4165c1
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
mov byte [ebp - 4], 0xc2
lea ecx, [ebp - 0x860]
push 0x19
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], eax
push str.TencentQQQQAntiPhishing
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
call fcn.00401a50
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0xc7
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x8c0]
call fcn.00426760
lea ecx, [ebp - 0x8c0]
mov byte [ebp - 4], 0xc8
cmp ecx, eax
je 0x415a79
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x415a6a
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x8c0]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0xc7
call fcn.00401850
mov byte [ebp - 4], 0xc9
mov edx, dword [ebp - 0x84c]
cmp edx, 8
jb 0x415acc
mov ecx, dword [ebp - 0x860]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415ac2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4165c6
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
mov byte [ebp - 4], 0xc2
lea ecx, [ebp - 0x848]
push 0xc
mov dword [ebp - 0x838], eax
mov dword [ebp - 0x834], eax
push str.tsurllib.bin
mov dword [ebp - 0x838], eax
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0xcd
push eax
lea eax, [ebp - 0xa40]
push eax
lea ecx, [ebp - 0x8c0]
call fcn.00426760
mov byte [ebp - 4], 0xd0
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x415b83
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415b79
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4165cb
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
xor dl, dl
mov byte [ebp - 4], 0xcf
lea ecx, [ebp - 0xa40]
call fcn.004274b0
test al, al
jne 0x415c73
cmp dword [0x49ad2c], 0
jg 0x415c2f
sub esp, 8
mov dword [ebp - 0xb58], 0
lea ecx, [ebp - 0xb50]
call fcn.00422bb0
mov dword [ebp - 0xab4], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab0], 0x150
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x150
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaac], eax
call fcn.00425610
or ebx, 0x2000
mov byte [ebp - 4], 0xd4
mov edx, str.delete_tsurllib.bin_after_reboot_
mov dword [ebp - 0xaa4], ebx
lea ecx, [ebp - 0xb50]
call fcn.00407130
mov dword [ebp - 4], 0xcf
test ebx, 0x2000
je 0x415c55
and ebx, 0xffffdfff
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaa4], ebx
call fcn.00425110
lea ecx, [ebp - 0xa40]
call fcn.00405f50
cmp eax, 0x104
jae 0x415c73
push 5
push 0
call fcn.00401810
push eax
call edi
xor eax, eax
mov dword [ebp - 0x838], 0
lea ecx, [ebp - 0x420]
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x838], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415cb0
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x848]
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0xd5
push eax
lea ecx, [ebp - 0x890]
call fcn.00401920
mov byte [ebp - 4], 0xd8
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x415d2c
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415d22
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4165d0
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
mov byte [ebp - 4], 0xd7
lea ecx, [ebp - 0x860]
push 0x1a
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], eax
push str.TencentQQQQProtectQScan
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
call fcn.00401a50
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0xdc
push eax
lea eax, [ebp - 0x878]
push eax
lea ecx, [ebp - 0x890]
call fcn.00426760
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], 0xdd
cmp ecx, eax
je 0x415dc6
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x415db7
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x890]
call fcn.00401a50
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], 0xdc
call fcn.00401850
mov byte [ebp - 4], 0xde
mov edx, dword [ebp - 0x84c]
cmp edx, 8
jb 0x415e19
mov ecx, dword [ebp - 0x860]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415e0f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4165d5
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
mov byte [ebp - 4], 0xd7
lea ecx, [ebp - 0x848]
push 0xf
mov dword [ebp - 0x838], eax
mov dword [ebp - 0x834], eax
push str.QScanEngine.dll
mov dword [ebp - 0x838], eax
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0xe2
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x890]
call fcn.00426760
mov byte [ebp - 4], 0xe5
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x415ed0
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415ec6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4165da
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
xor dl, dl
mov byte [ebp - 4], 0xe4
lea ecx, [ebp - 0x8a8]
call fcn.004274b0
cmp dword [0x49ad2c], 0
mov byte [ebp - 0xaa8], al
jg 0x415f8b
sub esp, 8
mov dword [ebp - 0xb58], 0
lea ecx, [ebp - 0xb50]
call fcn.00422bb0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xab4], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab0], 0x186
call esi
push 0x186
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaac], eax
call fcn.00425610
mov byte [ebp - 4], 0xe9
lea ecx, [ebp - 0xb50]
push dword [ebp - 0xaa8]
or ebx, 0x4000
mov edx, str.delete_QScanEngine.dll
mov dword [ebp - 0xaa4], ebx
call fcn.00407130
mov ecx, eax
call fcn.00416b00
jmp 0x415f91
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], 0xe4
test ebx, 0x4000
je 0x415fb7
and ebx, 0xffffbfff
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaa4], ebx
call fcn.00425110
push 0xa
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
lea ecx, [ebp - 0x848]
push str.config.dat
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0xea
push eax
lea eax, [ebp - 0xa28]
push eax
lea ecx, [ebp - 0x890]
call fcn.00426760
mov byte [ebp - 4], 0xed
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x41605b
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x416051
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4165df
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
xor dl, dl
mov byte [ebp - 4], 0xec
lea ecx, [ebp - 0xa28]
call fcn.004274b0
cmp dword [0x49ad2c], 0
mov byte [ebp - 0xaa8], al
jg 0x41610e
sub esp, 8
mov dword [ebp - 0xb58], 0
lea ecx, [ebp - 0xb50]
call fcn.00422bb0
mov dword [ebp - 0xab4], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab0], 0x18a
call esi
push 0x18a
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaac], eax
call fcn.00425610
mov byte [ebp - 4], 0xf1
lea ecx, [ebp - 0xb50]
push dword [ebp - 0xaa8]
or ebx, 0x8000
mov edx, str.delete_config.dat
mov dword [ebp - 0xaa4], ebx
call fcn.00407130
mov ecx, eax
call fcn.00416b00
mov dword [ebp - 4], 0xec
test ebx, 0x8000
je 0x416134
and ebx, 0xffff7fff
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaa4], ebx
call fcn.00425110
push 7
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
lea ecx, [ebp - 0x848]
push str.sig.dat
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0xf2
push eax
lea eax, [ebp - 0xa70]
push eax
lea ecx, [ebp - 0x890]
call fcn.00426760
mov byte [ebp - 4], 0xf5
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x4161d8
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4161ce
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4165e4
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
xor dl, dl
mov byte [ebp - 4], 0xf4
lea ecx, [ebp - 0xa70]
call fcn.004274b0
cmp dword [0x49ad2c], 0
mov byte [ebp - 0xaa8], al
jg 0x41628b
sub esp, 8
mov dword [ebp - 0xb58], 0
lea ecx, [ebp - 0xb50]
call fcn.00422bb0
mov dword [ebp - 0xab4], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab0], 0x18e
call esi
push 0x18e
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaac], eax
call fcn.00425610
mov byte [ebp - 4], 0xf9
lea ecx, [ebp - 0xb50]
push dword [ebp - 0xaa8]
or ebx, 0x10000
mov edx, str.delete_sig.dat_failed_
mov dword [ebp - 0xaa4], ebx
call fcn.00407130
mov ecx, eax
call fcn.00416b00
mov dword [ebp - 4], 0xf4
test ebx, 0x10000
je 0x4162b1
and ebx, 0xfffeffff
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xaa4], ebx
call fcn.00425110
push 0xa
xor eax, eax
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x864], 0
lea ecx, [ebp - 0x878]
push str.QSLSig.dat
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x864], 7
mov word [ebp - 0x878], ax
call fcn.00401a50
lea eax, [ebp - 0x878]
mov byte [ebp - 4], 0xfa
push eax
lea eax, [ebp - 0xa58]
push eax
lea ecx, [ebp - 0x890]
call fcn.00426760
mov byte [ebp - 4], 0xfd
mov eax, dword [ebp - 0x864]
cmp eax, 8
jb 0x416333
inc eax
lea ecx, [ebp - 0x878]
push eax
push dword [ebp - 0x878]
call fcn.00401c90
xor eax, eax
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x864], 7
mov word [ebp - 0x878], ax
xor dl, dl
mov dword [ebp - 4], 0xfc
lea ecx, [ebp - 0xa58]
call fcn.004274b0
cmp dword [0x49ad2c], 0
mov byte [ebp - 0xaa8], al
jg 0x4163b7
push 0
push 0x192
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb58]
call fcn.00424f80
mov dword [ebp - 4], 0x101
lea ecx, [eax + 8]
push dword [ebp - 0xaa8]
or ebx, 0x20000
mov edx, str.delete_QSLSig.dat_failed_
mov dword [ebp - 0xaa4], ebx
call fcn.00407130
mov ecx, eax
call fcn.00416b00
mov dword [ebp - 4], 0xfc
test ebx, 0x20000
je 0x4163d1
lea ecx, [ebp - 0xb58]
call fcn.00425110
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0xf4
call fcn.00401850
lea ecx, [ebp - 0xa70]
mov byte [ebp - 4], 0xec
call fcn.00401850
lea ecx, [ebp - 0xa28]
mov byte [ebp - 4], 0xe4
call fcn.00401850
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0xd7
call fcn.00401850
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], 0xcf
call fcn.00401850
lea ecx, [ebp - 0xa40]
mov byte [ebp - 4], 0xc2
call fcn.00401850
lea ecx, [ebp - 0x8c0]
mov byte [ebp - 4], 0x99
call fcn.00401850
lea ecx, [ebp - 0xa10]
mov byte [ebp - 4], 0x94
call fcn.00401850
lea ecx, [ebp - 0xa88]
mov byte [ebp - 4], 0x85
call fcn.00401850
lea ecx, [ebp - 0xaa0]
mov byte [ebp - 4], 0x74
call fcn.00401850
lea ecx, [ebp - 0x9f8]
mov byte [ebp - 4], 0x6d
call fcn.00401850
lea ecx, [ebp - 0x950]
mov byte [ebp - 4], 0x66
call fcn.00401850
lea ecx, [ebp - 0x968]
mov byte [ebp - 4], 0x5f
call fcn.00401850
lea ecx, [ebp - 0x8f0]
mov byte [ebp - 4], 0x58
call fcn.00401850
lea ecx, [ebp - 0x920]
mov byte [ebp - 4], 0x51
call fcn.00401850
lea ecx, [ebp - 0x980]
mov byte [ebp - 4], 0x4a
call fcn.00401850
lea ecx, [ebp - 0x998]
mov byte [ebp - 4], 0x43
call fcn.00401850
lea ecx, [ebp - 0x8d8]
mov byte [ebp - 4], 0x31
call fcn.00401850
lea ecx, [ebp - 0x9b0]
mov byte [ebp - 4], 0x19
call fcn.00401850
lea ecx, [ebp - 0x9c8]
mov byte [ebp - 4], 0xa
call fcn.00401850
lea ecx, [ebp - 0x938]
mov byte [ebp - 4], 9
call fcn.00401850
lea ecx, [ebp - 0x908]
mov byte [ebp - 4], 1
call fcn.00401850
lea ecx, [ebp - 0x9e0]
mov dword [ebp - 4], 0xffffffff
call fcn.00401850
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f786
mov esp, ebp
pop ebp
ret
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
int3