Function at 0x4c0e50
Capabilities:
Check if file exists
Copy file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51466d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x550144]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004c2720
lea ecx, [ebp - 0x2c]
call fcn.00479be0
push 0
push 0
push str..qbox
push SysReAllocString
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00479c10
test eax, eax
je 0x4c0ebd
push str.QQPCMgr.qbox
push 0x5364dc
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0
push 0
push str.QQPCMgr.qbox
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c0ee9
push 0x51ded8
push 0x5364dc
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0
push 0
push str.QQPCMgr.qboxDefaultIcon
push SysReAllocString
lea ecx, [ebp - 0x2c]
lea edi, [esi + 4]
call fcn.00479c10
test eax, eax
je 0x4c0f35
push str.imageqbox.ico_0
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0048c050
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
push 0x5364dc
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
push 0
push 0
push str.QQPCMgr.qbox_shell
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c0f61
push 0x5364dc
push 0x5364dc
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0
push 0
push str.QQPCMgr.qbox_shellopen
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c0f8d
push 0x51dfa8
push 0x5364dc
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0
push 0
push str.QQPCMgr.qbox_shellcommand
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c0fd6
push str.QQPCFileSafe.exe___1_
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0048c050
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
push 0x5364dc
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
push 0
push 0
push str.QMRemote
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c1050
push 0x537830
push 0x5364dc
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push edi
lea eax, [ebp - 0x38]
push 0x5384e0
push eax
call fcn.0048cb00
push str.QMRemote.exe_
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 1
push eax
call fcn.0048c050
add esp, 0x18
mov ecx, eax
call fcn.0044c0a0
push eax
push str.URL_Protocol
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.0044c080
push 0
push 0
push str.QMRemoteShell
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c107c
push 0x5364dc
push 0x5364dc
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0
push 0
push str.QMRemoteShellOpen
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c10a8
push 0x5364dc
push 0x5364dc
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0
push 0
push str.QMRemoteShellOpenCommand
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c1110
push edi
lea eax, [ebp - 0x38]
push 0x5384e0
push eax
call fcn.0048cb00
push str.QQPCMgr.exe___pullRemote___1_
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.0048c050
add esp, 0x18
mov ecx, eax
call fcn.0044c0a0
push eax
push 0x5364dc
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.0044c080
push 0
push 0
push str.QMSoft
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c118a
push 0x537830
push 0x5364dc
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push edi
lea eax, [ebp - 0x38]
push 0x5384e0
push eax
call fcn.0048cb00
push str.QQPCSoftMgr.exe_
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 3
push eax
call fcn.0048c050
add esp, 0x18
mov ecx, eax
call fcn.0044c0a0
push eax
push str.URL_Protocol
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.0044c080
push 0
push 0
push str.QMSoftShell
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c11b6
push 0x5364dc
push 0x5364dc
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0
push 0
push str.QMSoftShellOpen
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c11e2
push 0x5364dc
push 0x5364dc
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0
push 0
push str.QMSoftShellOpenCommand
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c124a
push edi
lea eax, [ebp - 0x38]
push 0x5384e0
push eax
call fcn.0048cb00
push str.QQPCMgr.exe___pullSoft___1_
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 4
push eax
call fcn.0048c050
add esp, 0x18
mov ecx, eax
call fcn.0044c0a0
push eax
push 0x5364dc
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.0044c080
cmp dword [esi + 0x14], 0
jne 0x4c14c8
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c134e
push 0x5384e0
lea ecx, [ebp - 0x34]
call fcn.0044f140
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x34]
call fcn.0048c580
push str.QQPCTray.exe_
lea ecx, [ebp - 0x34]
call fcn.0048c580
lea ecx, [ebp - 0x34]
call fcn.0044c0a0
push eax
push str.DisplayIcon
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0x537830
push 0x51ba3c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0x5384e0
lea ecx, [ebp - 0x34]
call fcn.0044f4c0
mov ecx, edi
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x34]
call fcn.0048c580
push str.Uninst.exe_
lea ecx, [ebp - 0x34]
call fcn.0048c580
lea ecx, [ebp - 0x34]
call fcn.0044c0a0
push eax
push str.UninstallString
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [esi + 0xc]
call fcn.0044c0a0
push eax
push 0x51e2ec
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push str.https:__guanjia.qq.com_
push str.URLInfoAbout
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0x51e358
push str.Publisher
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.0044c080
cmp dword [esi + 0x14], 0
jne 0x4c14c8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.004c30c0
test eax, eax
je 0x4c14c8
push edi
lea ecx, [ebp - 0x30]
call fcn.0048d090
push str.QQPCTray.exe
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 6
call fcn.0048c580
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x30]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push edi
lea ecx, [ebp - 0x38]
call fcn.0048d090
push str.QQPCExternal.exe
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 7
call fcn.0048c580
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x38]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push edi
lea ecx, [ebp - 0x3c]
call fcn.0048d090
push str.QQPCSoftMgr.exe
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 8
call fcn.0048c580
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x3c]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push edi
lea ecx, [ebp - 0x44]
call fcn.0048d090
push str.QMSecurityLab.exe
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 9
call fcn.0048c580
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x44]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push edi
lea ecx, [ebp - 0x40]
call fcn.0048d090
push str.QMLspPing.exe
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xa
call fcn.0048c580
push str._PERPROCESSSYSTEMDPIFORCEON_HIGHDPIAWARE
lea ecx, [ebp - 0x40]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push edi
lea ecx, [ebp - 0x34]
call fcn.0048d090
push str.NetworkMon.exe
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xb
call fcn.0048c580
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x34]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x34]
call fcn.0044c080
lea ecx, [ebp - 0x40]
call fcn.0044c080
lea ecx, [ebp - 0x44]
call fcn.0044c080
lea ecx, [ebp - 0x3c]
call fcn.0044c080
lea ecx, [ebp - 0x38]
call fcn.0044c080
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.0044c080
push 0
push 0
push str.SYSTEMCurrentControlSet_servicesQQPCRTP
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c14f1
push 0
push str.RtpFlag
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 0
push 0
push str.SOFTWARETencent
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c151d
push 0x519090
push str.QQPCFlag
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0
push 0
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c1645
mov ecx, edi
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x28]
call fcn.0048cfc0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xc
push eax
call fcn.00487420
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.0044a630
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
mov ebx, eax
push ebx
push str.WriteReg_InstallDir__Result_:__d
push 0x550bb8
call fcn.0048d540
add esp, 0xc
cmp dword [esi + 0x20], 0
je 0x4c1597
test ebx, ebx
je 0x4c1597
mov eax, 1
jmp 0x4c1599
xor eax, eax
lea ecx, [esi + 0xc]
mov dword [esi + 0x20], eax
call fcn.0044c0a0
push eax
push str.Version
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
mov ebx, eax
push ebx
push str.WriteReg_Version__Result_:__d
push 0x550bb8
call fcn.0048d540
add esp, 0xc
cmp dword [esi + 0x20], 0
je 0x4c15d8
test ebx, ebx
je 0x4c15d8
mov eax, 1
jmp 0x4c15da
xor eax, eax
push str.QQPCMgr.exe
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0048c050
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
push str.ExeString
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
push 1
push str.IdleScanTip
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 0
push str.FirstRun
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 1
push str.IsTrayCrashed
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a640
push 0
push 0
push str.SOFTWARETencentQQPCMgrVulFW
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c166e
push 1
push str.bCameraProtection
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c16a2
push str.QMTray
lea ecx, [ebp - 0x2c]
call fcn.00492d40
push 0x51e674
lea ecx, [ebp - 0x2c]
call fcn.00492d40
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunQQDisabled
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c16d6
push 0x51e674
lea ecx, [ebp - 0x2c]
call fcn.00492d40
push str._QQPCTray
lea ecx, [ebp - 0x2c]
call fcn.00492d40
push 0
push 0
push str.QMConfigQQDoctorQQDoctorComCfg
push reloc.WS2_32.dll_closesocket
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c16fd
push str.defCoveredRemoteSetting
lea ecx, [ebp - 0x2c]
call fcn.00492d40
mov ecx, esi
call fcn.004c1f80
call fcn.004878d0
test eax, eax
jne 0x4c175d
push str.Set_TSKSP_autostart
push 0x550bb8
call fcn.0048d540
add esp, 8
lea ecx, [ebp - 0x2c]
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTSKSP
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00479c10
test eax, eax
je 0x4c174b
push 0x519090
push str.autostart
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push str.Set_TSKSP_autostart_end
push 0x550bb8
call fcn.0048d540
add esp, 8
push str.Set_QQSoftMgr_reg
push 0x550bb8
call fcn.0048d540
add esp, 8
lea ecx, [ebp - 0x2c]
push 0
push 0
push str.SOFTWARETENCENTDeskUpdateQQSoftMgr
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00479c10
lea edi, [esi + 4]
test eax, eax
je 0x4c1847
push str.QQPCSoftMgr.exe
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0048c050
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
push str.ExeString
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x34]
call fcn.0047d1f0
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0xd
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00479d70
test eax, eax
je 0x4c183b
lea ecx, [ebp - 0x34]
call fcn.0048d370
test al, al
jne 0x4c183b
lea ecx, [ebp - 0x34]
call fcn.0044f760
test eax, eax
je 0x4c183b
push ecx
mov ecx, esp
push edi
call fcn.0048d090
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.004c24d0
mov ecx, eax
call fcn.0044c0a0
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
push str.0.500
push str.Version
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.0044c080
push str.Set_TsFltMgr_reg
push 0x550bb8
call fcn.0048d540
add esp, 8
call fcn.004878d0
test eax, eax
jne 0x4c1dfd
push eax
push eax
push str.SYSTEMCurrentControlSetServicesTsFltMgr
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c19e3
push str.DeleteFlag
lea ecx, [ebp - 0x2c]
call fcn.00492d40
lea eax, [ebp - 0x28]
push eax
call fcn.00489080
add esp, 4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xe
call fcn.0048f160
lea ecx, [ebp - 0x28]
call fcn.0044a630
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push str.TsFltMgr.sys
lea ecx, [ebp - 0x34]
call fcn.0044f140
mov byte [ebp - 4], 0xf
call fcn.00487380
test eax, eax
je 0x4c18ea
push str.TsFltMgr_ev.sys
lea ecx, [ebp - 0x34]
call fcn.0044f4c0
lea ecx, [ebp - 0x34]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x28]
call fcn.0048f4e0
lea eax, [ebp - 0x34]
push eax
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004970c0
add esp, 0xc
lea ecx, [ebp - 0x28]
mov esi, eax
push 0
call fcn.0044a630
push eax
mov ecx, esi
call fcn.0044c0a0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x28]
call fcn.0044a630
push eax
call ebx
test eax, eax
je 0x4c19b4
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push str.System32drivers_
push eax
call fcn.0048cb00
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
push str.ImagePath
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
push 0
push str.ErrorControl
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 0
push str.Start
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 1
push str.Type
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push str.TsFltMgr
push 0x51ba3c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
jmp 0x4c19cf
lea ecx, [ebp - 0x28]
call fcn.0044a630
push eax
push str.Not_Found__ws
push 0x550bb8
call fcn.0048d540
add esp, 0xc
lea ecx, [ebp - 0x34]
call fcn.0044c080
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a640
push str.WriteRegStr_TSKSP_..begin
push 0x550bb8
call fcn.0048d540
add esp, 8
lea ecx, [ebp - 0x2c]
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTSKSP
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00479c10
test eax, eax
je 0x4c1b54
push str.DeleteFlag
lea ecx, [ebp - 0x2c]
call fcn.00492d40
mov ecx, edi
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x28]
call fcn.0048cfc0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x10
call fcn.0048f160
lea ecx, [ebp - 0x28]
call fcn.0044a630
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push str.TSKsp.sys
lea ecx, [ebp - 0x34]
call fcn.0044f140
mov byte [ebp - 4], 0x11
call fcn.00487380
test eax, eax
je 0x4c1a79
push str.TSKsp_ev.sys
lea ecx, [ebp - 0x34]
call fcn.0044f4c0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.004970c0
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
call ebx
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.0044c080
test esi, esi
je 0x4c1b40
push edi
lea eax, [ebp - 0x38]
push 0x51b9fc
push eax
call fcn.0048cb00
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x12
push ecx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004970c0
add esp, 0x18
mov ecx, eax
call fcn.0044c0a0
push eax
push str.ImagePath
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x38]
call fcn.0044c080
push 0
push str.ErrorControl
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 1
push str.Start
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 1
push str.Type
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push str.TSKSP
push 0x51ba3c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0x519090
push str.autostart
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x34]
call fcn.0044c080
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a640
push str.WriteRegStr_TSKSP_..end
push 0x550bb8
call fcn.0048d540
add esp, 8
lea ecx, [ebp - 0x2c]
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTSSysKit
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00479c10
test eax, eax
je 0x4c1c9d
push str.DeleteFlag
lea ecx, [ebp - 0x2c]
call fcn.00492d40
mov ecx, edi
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x28]
call fcn.0048cfc0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x13
call fcn.0048f160
lea ecx, [ebp - 0x28]
call fcn.0044a630
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0x51c008
lea ecx, [ebp - 0x34]
call fcn.0044f140
mov byte [ebp - 4], 0x14
call fcn.00487380
test eax, eax
je 0x4c1bea
push str.TSSysKit_ev.sys
lea ecx, [ebp - 0x34]
call fcn.0044f4c0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.004970c0
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
call ebx
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.0044c080
test esi, esi
je 0x4c1c89
push edi
lea eax, [ebp - 0x38]
push 0x51b9fc
push eax
call fcn.0048cb00
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x15
push ecx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004970c0
add esp, 0x18
mov ecx, eax
call fcn.0044c0a0
push eax
push str.ImagePath
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x38]
call fcn.0044c080
push 0
push str.ErrorControl
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 1
push str.Start
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 1
push str.Type
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
lea ecx, [ebp - 0x34]
call fcn.0044c080
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a640
push str.QMIEProtect.sys
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0048c050
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
call ebx
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.0044c080
test esi, esi
je 0x4c1dfd
push 0
push 0
push str.SYSTEMCurrentControlSetServicesQMIEProtect
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c1dfd
push str.DeleteFlag
lea ecx, [ebp - 0x2c]
call fcn.00492d40
mov ecx, edi
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x28]
call fcn.0048cfc0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x16
call fcn.0048f160
lea ecx, [ebp - 0x28]
call fcn.0044a630
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push str.QMIEProtect.sys
lea ecx, [ebp - 0x30]
call fcn.0044f140
mov byte [ebp - 4], 0x17
call fcn.00487380
test eax, eax
je 0x4c1d4f
push str.QMIEProtect_ev.sys
lea ecx, [ebp - 0x30]
call fcn.0044f4c0
push edi
lea eax, [ebp - 0x3c]
push 0x51b9fc
push eax
call fcn.0048cb00
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x18
push ecx
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004970c0
add esp, 0x18
mov ecx, eax
call fcn.0044c0a0
push eax
push str.ImagePath
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x38]
call fcn.0044c080
lea ecx, [ebp - 0x3c]
call fcn.0044c080
push 0
push str.ErrorControl
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 2
push str.Start
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 1
push str.Type
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push str.QMIEProtect
push 0x51ba3c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0x519090
push str.autostart
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a640
call fcn.004878d0
test eax, eax
je 0x4c1e6b
push 0
push 0
push str.SYSTEMCurrentControlSetServicesQQSysMonX64
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c1e6b
push str.DeleteFlag
lea ecx, [ebp - 0x2c]
call fcn.00492d40
mov ecx, edi
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x28]
call fcn.0048cfc0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x19
call fcn.0048f160
lea ecx, [ebp - 0x28]
call fcn.0044a630
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a640
mov ecx, 0x553028
call fcn.004b1720
test eax, eax
jne 0x4c1f15
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x38], eax
call fcn.00479be0
push 0
push 1
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x1a
call fcn.00479c10
test eax, eax
je 0x4c1f0d
lea eax, [ebp - 0x38]
push eax
push str.SupplyID
lea ecx, [ebp - 0x30]
call fcn.00479d20
mov eax, dword [ebp - 0x38]
cmp eax, 0x7270e00
jb 0x4c1ec8
cmp eax, 0x7bfa47f
jbe 0x4c1ed4
add eax, 0xfffe2b3f
cmp eax, 0x270e
ja 0x4c1f0d
call fcn.004878d0
lea ecx, [ebp - 0x2c]
push 0
push 0
test eax, eax
jne 0x4c1eeb
push str.SYSTEMCurrentControlSetServicesQQSysMon
jmp 0x4c1ef0
push str.SYSTEMCurrentControlSetServicesQQSysMonX64
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00479c10
test eax, eax
je 0x4c1f0d
push 3
push str.spvalue
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
lea ecx, [ebp - 0x30]
call fcn.00479bf0
lea ecx, [ebp - 0x2c]
call fcn.00479bf0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004de46d
mov esp, ebp
pop ebp
ret