Function at 0x419e20
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get startup folder
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47446b
mov eax, dword fs:[0]
push eax
sub esp, 0x71c
mov eax, dword [0x498068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x724], ecx
lea ecx, [ebp - 0x688]
mov dword [ebp - 0x728], 0
xor edi, edi
call fcn.00401900
push 0x208
lea eax, [ebp - 0x420]
mov dword [ebp - 4], edi
push edi
push eax
call fcn.00452050
mov byte [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x660], edi
mov dword [ebp - 0x65c], edi
mov dword [ebp - 0x660], edi
mov dword [ebp - 0x65c], 7
mov word [ebp - 0x670], ax
push 0x208
push eax
lea eax, [ebp - 0x628]
mov byte [ebp - 4], 2
push eax
call fcn.00452050
add esp, 0x18
lea eax, [ebp - 0x628]
push edi
push 0x2b
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x628]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x419ee0
sub ecx, edx
lea eax, [ebp - 0x628]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x670]
call fcn.00401a50
push 7
xor eax, eax
mov dword [ebp - 0x6a8], 0
mov dword [ebp - 0x6a4], 0
lea ecx, [ebp - 0x6b8]
push 0x484908
mov dword [ebp - 0x6a8], 0
mov dword [ebp - 0x6a4], 7
mov word [ebp - 0x6b8], ax
call fcn.00401a50
lea eax, [ebp - 0x670]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x658]
call fcn.00401920
lea eax, [ebp - 0x6b8]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x718]
push eax
lea ecx, [ebp - 0x658]
call fcn.00426760
lea ecx, [ebp - 0x700]
mov byte [ebp - 4], 5
push ecx
mov ecx, eax
call fcn.00426a40
push eax
lea ecx, [ebp - 0x6e8]
mov byte [ebp - 4], 6
call fcn.00401920
lea ecx, [ebp - 0x6e8]
call fcn.00426940
lea ecx, [ebp - 0x700]
mov byte [ebp - 4], 8
call fcn.00401850
lea ecx, [ebp - 0x718]
mov byte [ebp - 4], 9
call fcn.00401850
lea ecx, [ebp - 0x658]
mov byte [ebp - 4], 0xa
call fcn.00401850
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x6a4]
cmp edx, 8
jb 0x41a016
mov ecx, dword [ebp - 0x6b8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a00c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41aef2
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x6a8], 0
mov dword [ebp - 0x6a4], 7
mov word [ebp - 0x6b8], ax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x640]
push 0x1b
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x62c], eax
push str.QQProtectBinQQProtect.exe
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
call fcn.00401a50
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x6a0]
push eax
lea ecx, [ebp - 0x6e8]
call fcn.00426760
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0x11
cmp ecx, eax
je 0x41a0b0
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x41a0a1
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x688]
call fcn.00401a50
lea ecx, [ebp - 0x6a0]
mov byte [ebp - 4], 0x10
call fcn.00401850
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x62c]
cmp edx, 8
jb 0x41a103
mov ecx, dword [ebp - 0x640]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a0f9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41aef7
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0xb
call fcn.00401810
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call ebx
cmp eax, 0xffffffff
je 0x41a1b7
lea ecx, [ebp - 0x6e8]
mov byte [ebp - 4], 2
mov edi, 1
call fcn.00401850
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x65c]
cmp edx, 8
jb 0x41a195
mov ecx, dword [ebp - 0x670]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a18b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41aefc
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x65c], 7
mov word [ebp - 0x670], ax
jmp 0x41ad7c
cmp dword [0x49bae4], 0
jne 0x41a1f4
push 0x28
call fcn.0044f797
add esp, 4
mov ecx, eax
call fcn.00424770
push 0
mov esi, eax
push esi
push 0x49bae4
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x41a1f4
test esi, esi
je 0x41a1f4
push 0x28
push esi
call fcn.0044f7c7
add esp, 8
mov eax, dword [0x49bae4]
mov edx, str.SYSTEMCurrentControlSet_servicesQQProtectX64
mov ecx, str.SYSTEMCurrentControlSet_servicesQQProtect
cmp dword [eax + 0x24], 1
lea eax, [ebp - 0x71c]
push eax
push 0x20019
push 0
cmove ecx, edx
mov dword [ebp - 0x71c], 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41a883
mov esi, dword [ebp - 0x71c]
test esi, esi
je 0x41a87d
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x720], 0x208
push 0
push eax
call fcn.00452050
add esp, 0xc
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push str.QPPath
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
test eax, eax
jne 0x41a3cd
mov eax, dword [ebp - 0x720]
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x41af0b
xor ecx, ecx
mov dword [ebp - 0x630], ecx
mov word [ebp + eax - 0x218], cx
xor eax, eax
mov dword [ebp - 0x62c], ecx
mov dword [ebp - 0x630], ecx
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x62c], 7
lea edx, [ecx + 2]
mov word [ebp - 0x640], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a2e0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x640]
call fcn.00401a50
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0x658]
call fcn.00401920
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x658]
cmp dword [ebp - 0x644], 8
lea ecx, [ebp - 0x688]
push dword [ebp - 0x648]
cmovae eax, dword [ebp - 0x658]
push eax
call fcn.00401a50
lea ecx, [ebp - 0x658]
mov byte [ebp - 4], 0x1a
call fcn.00401850
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0x62c]
cmp edx, 8
jb 0x41a395
mov ecx, dword [ebp - 0x640]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a38b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41af01
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0xb
call fcn.00401810
push eax
call ebx
cmp eax, 0xffffffff
jne 0x41a7f3
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x420]
push eax
push 0
push 0
push str.Path
push dword [ebp - 0x71c]
call esi
test eax, eax
jne 0x41a7f8
mov eax, dword [ebp - 0x720]
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x41af0b
xor ecx, ecx
mov word [ebp + eax - 0x420], cx
xor eax, eax
mov dword [ebp - 0x648], ecx
mov dword [ebp - 0x644], ecx
push 0x1b
mov dword [ebp - 0x648], ecx
lea ecx, [ebp - 0x658]
push str.QQProtectBinQQProtect.exe
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
call fcn.00401a50
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x420]
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a487
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x640]
call fcn.00401a50
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00401920
lea eax, [ebp - 0x658]
mov byte [ebp - 4], 0x22
push eax
lea eax, [ebp - 0x6d0]
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00426760
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0x23
cmp ecx, eax
je 0x41a503
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x41a4f4
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x688]
call fcn.00401a50
lea ecx, [ebp - 0x6d0]
mov byte [ebp - 4], 0x22
call fcn.00401850
lea ecx, [ebp - 0x6a0]
mov byte [ebp - 4], 0x21
call fcn.00401850
mov byte [ebp - 4], 0x24
mov edx, dword [ebp - 0x62c]
cmp edx, 8
jb 0x41a565
mov ecx, dword [ebp - 0x640]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a55b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41af06
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
mov byte [ebp - 4], 0x28
mov edx, dword [ebp - 0x644]
cmp edx, 8
jb 0x41a5c6
mov ecx, dword [ebp - 0x658]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a5bc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41af10
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0xb
call fcn.00401810
push eax
call ebx
cmp eax, 0xffffffff
jne 0x41a7f3
push 0x1f
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 0
lea ecx, [ebp - 0x640]
push str.BinQQProtectBinQQProtect.exe
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
call fcn.00401a50
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x420]
xor eax, eax
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a680
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x658]
call fcn.00401a50
lea eax, [ebp - 0x658]
mov byte [ebp - 4], 0x2d
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00401920
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0x2e
push eax
lea eax, [ebp - 0x6d0]
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00426760
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0x2f
cmp ecx, eax
je 0x41a6fc
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x41a6ed
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x688]
call fcn.00401a50
lea ecx, [ebp - 0x6d0]
mov byte [ebp - 4], 0x2e
call fcn.00401850
lea ecx, [ebp - 0x6a0]
mov byte [ebp - 4], 0x2d
call fcn.00401850
mov byte [ebp - 4], 0x30
mov edx, dword [ebp - 0x644]
cmp edx, 8
jb 0x41a75e
mov ecx, dword [ebp - 0x658]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a754
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41af15
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
mov byte [ebp - 4], 0x34
mov edx, dword [ebp - 0x62c]
cmp edx, 8
jb 0x41a7bf
mov ecx, dword [ebp - 0x640]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a7b5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41af1a
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0xb
call fcn.00401810
push eax
call ebx
cmp eax, 0xffffffff
je 0x41a7f8
mov edi, 1
push dword [ebp - 0x71c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x41a883
lea ecx, [ebp - 0x6e8]
mov byte [ebp - 4], 2
call fcn.00401850
mov byte [ebp - 4], 0x38
mov edx, dword [ebp - 0x65c]
cmp edx, 8
jb 0x41a85b
mov ecx, dword [ebp - 0x670]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a851
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41af1f
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x65c], 7
mov word [ebp - 0x670], ax
jmp 0x41ad7c
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x71c]
mov dword [ebp - 0x71c], 0
push eax
push 0x20019
push 0
push str.SOFTWARETencentQQ2009
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41adb2
mov eax, dword [ebp - 0x71c]
test eax, eax
je 0x41adb2
lea ecx, [ebp - 0x720]
mov dword [ebp - 0x720], 0x208
push ecx
lea ecx, [ebp - 0x420]
push ecx
push 0
push 0
push str.Install
push eax
call esi
test eax, eax
jne 0x41acf8
mov eax, dword [ebp - 0x720]
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x41af0b
xor ecx, ecx
mov word [ebp + eax - 0x420], cx
xor eax, eax
mov dword [ebp - 0x630], ecx
mov dword [ebp - 0x62c], ecx
push 0x1b
mov dword [ebp - 0x630], ecx
lea ecx, [ebp - 0x640]
push str.QQProtectBinQQProtect.exe
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
call fcn.00401a50
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x420]
xor eax, eax
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a980
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x658]
call fcn.00401a50
lea eax, [ebp - 0x658]
mov byte [ebp - 4], 0x3d
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00401920
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0x3e
push eax
lea eax, [ebp - 0x6d0]
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00426760
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0x3f
cmp ecx, eax
je 0x41a9fc
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x41a9ed
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x688]
call fcn.00401a50
lea ecx, [ebp - 0x6d0]
mov byte [ebp - 4], 0x3e
call fcn.00401850
lea ecx, [ebp - 0x6a0]
mov byte [ebp - 4], 0x3d
call fcn.00401850
mov byte [ebp - 4], 0x40
mov edx, dword [ebp - 0x644]
cmp edx, 8
jb 0x41aa5e
mov ecx, dword [ebp - 0x658]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41aa54
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41af24
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
mov byte [ebp - 4], 0x44
mov edx, dword [ebp - 0x62c]
cmp edx, 8
jb 0x41aabf
mov ecx, dword [ebp - 0x640]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41aab5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41af29
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0xb
call fcn.00401810
push eax
call ebx
cmp eax, 0xffffffff
jne 0x41acf3
push 0x1f
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 0
lea ecx, [ebp - 0x640]
push str.BinQQProtectBinQQProtect.exe
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
call fcn.00401a50
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x420]
xor eax, eax
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41ab80
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x658]
call fcn.00401a50
lea eax, [ebp - 0x658]
mov byte [ebp - 4], 0x49
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00401920
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0x4a
push eax
lea eax, [ebp - 0x6d0]
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00426760
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0x4b
cmp ecx, eax
je 0x41abfc
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x41abed
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x688]
call fcn.00401a50
lea ecx, [ebp - 0x6d0]
mov byte [ebp - 4], 0x4a
call fcn.00401850
lea ecx, [ebp - 0x6a0]
mov byte [ebp - 4], 0x49
call fcn.00401850
mov byte [ebp - 4], 0x4c
mov edx, dword [ebp - 0x644]
cmp edx, 8
jb 0x41ac5e
mov ecx, dword [ebp - 0x658]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41ac54
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41af2e
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
mov byte [ebp - 4], 0x50
mov edx, dword [ebp - 0x62c]
cmp edx, 8
jb 0x41acbf
mov ecx, dword [ebp - 0x640]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41acb5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41af33
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0xb
call fcn.00401810
push eax
call ebx
cmp eax, 0xffffffff
je 0x41acf8
mov edi, 1
push dword [ebp - 0x71c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x41adb2
lea ecx, [ebp - 0x6e8]
mov byte [ebp - 4], 2
call fcn.00401850
mov byte [ebp - 4], 0x54
mov edx, dword [ebp - 0x65c]
cmp edx, 8
jb 0x41ad5f
mov ecx, dword [ebp - 0x670]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41ad55
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41af38
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x65c], 7
mov word [ebp - 0x670], ax
mov ebx, dword [ebp - 0x724]
lea eax, [ebp - 0x688]
mov byte [ebp - 4], 0
cmp ebx, eax
je 0x41ae2b
cmp dword [ebp - 0x674], 8
mov ecx, ebx
push dword [ebp - 0x678]
cmovae eax, dword [ebp - 0x688]
push eax
call fcn.00401a50
jmp 0x41ae2b
lea ecx, [ebp - 0x6e8]
mov byte [ebp - 4], 2
call fcn.00401850
mov byte [ebp - 4], 0x58
mov edx, dword [ebp - 0x65c]
cmp edx, 8
jb 0x41ae05
mov ecx, dword [ebp - 0x670]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41adfb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41af3d
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x65c], 7
mov word [ebp - 0x670], ax
mov ebx, dword [ebp - 0x724]
mov byte [ebp - 4], al
cmp dword [0x49ad2c], 0
jg 0x41aea7
sub esp, 8
mov dword [ebp - 0xc0], 0
lea ecx, [ebp - 0xb8]
call fcn.00422bb0
mov dword [ebp - 0x1c], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetuputilqpqq_protect.cpp
mov dword [ebp - 0x18], 0x85
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x85
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetuputilqpqq_protect.cpp
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x14], eax
call fcn.00425610
mov byte [ebp - 4], 0x5c
mov dword [ebp - 0x728], 1
cmp dword [ebx + 0x14], 8
jb 0x41ae8e
mov ebx, dword [ebx]
mov edx, str.GetQQProtectFilePath:
lea ecx, [ebp - 0xb8]
call fcn.00407130
mov edx, ebx
mov ecx, eax
call fcn.00425a00
mov dword [ebp - 4], 0
test byte [ebp - 0x728], 1
je 0x41aec2
lea ecx, [ebp - 0xc0]
call fcn.00425110
lea ecx, [ebp - 0x688]
mov dword [ebp - 4], 0xffffffff
call fcn.00401850
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f786
mov esp, ebp
pop ebp
ret
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.0044f927
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
int3