Function at 0x405170
Capabilities:
Check if file exists
Get common file path
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7a4
mov eax, dword [0x4508e0]
xor eax, esp
mov dword [esp + 0x7a0], eax
push esi
mov esi, dword [ebp + 0x10]
push 0x104
lea eax, [esp + 0x8c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [esi], 0
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
jne 0x4051c1
xor ecx, ecx
jmp 0x4051cf
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4051c6
sub ecx, edx
push ecx
push esi
lea ecx, [esp + 0x20]
call fcn.00403760
push 9
push str.check_reg
push dword [esp + 0x30]
push ecx
lea ecx, [esp + 0x28]
call fcn.004031a0
test eax, eax
jne 0x40528a
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push connect
call esi
push 0
push 0
push 0
push 2
push str.TQOS_REPORT
push 0
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x405450
lea eax, [esp + 8]
push eax
push 0x20006
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push connect
call esi
test eax, eax
jne 0x405450
lea ecx, [esp + 0x88]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405260
sub ecx, edx
push ecx
lea eax, [esp + 0x8c]
push eax
push 1
push 0
push str.TQOS_REPORT
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x405450
lea ecx, [esp + 8]
mov dword [esp + 8], 5
call fcn.00408a40
lea eax, [esp + 0x298]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x298]
push eax
lea eax, [esp + 0x194]
push str._smho_usercfgthreshold.txt
push eax
call fcn.0040b142
add esp, 0xc
lea eax, [esp + 0x190]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x405450
push 0x400
lea eax, [esp + 0x3a4]
push eax
push 0x1f40
push str.ied_tqos.qq.com
push 0x64
push 0x461f4c
call fcn.00439780
add esp, 0x18
test eax, eax
jns 0x405333
mov edx, str.tqos_init_failed
mov ecx, 0x45d100
call fcn.00408790
mov esi, eax
push ecx
mov ecx, esi
call fcn.00405610
mov ecx, esi
call fcn.00402080
or esi, 0xffffffff
jmp 0x405452
xorps xmm0, xmm0
lea ecx, [esp + 0x78]
mov byte [esp + 0x78], 0
movq qword [esp + 0x79], xmm0
mov dword [esp + 0x81], 0
mov word [esp + 0x85], 0
mov byte [esp + 0x87], 0
call fcn.00404230
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x64]
call fcn.00401d30
push str.from_reporter:
lea ecx, [esp + 0x34]
call fcn.00401d30
lea ecx, [esp + 0x48]
call fcn.00404760
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00402570
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x10]
call fcn.00402570
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x10]
call fcn.00402570
lea ecx, [esp + 0xc]
call fcn.00405000
push 0x461f4c
call fcn.00437e60
add esp, 4
lea ecx, [esp + 0xc]
call fcn.004033e0
cmp dword [esp + 0x5c], 0x10
jb 0x405400
push dword [esp + 0x48]
call fcn.0040af83
add esp, 4
cmp dword [esp + 0x44], 0x10
mov dword [esp + 0x5c], 0xf
mov dword [esp + 0x58], 0
mov byte [esp + 0x48], 0
jb 0x405428
push dword [esp + 0x30]
call fcn.0040af83
add esp, 4
cmp dword [esp + 0x74], 0x10
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], 0
mov byte [esp + 0x30], 0
jb 0x405450
push dword [esp + 0x60]
call fcn.0040af83
add esp, 4
xor esi, esi
cmp dword [esp + 0x2c], 0x10
jb 0x405465
push dword [esp + 0x18]
call fcn.0040af83
add esp, 4
mov ecx, dword [esp + 0x7a4]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040a11d
mov esp, ebp
pop ebp
ret 0x10