Function at 0x435a50
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d3868
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x10], edi
push 0x4ed4c8
push 0x48
mov dword [ebp - 4], edi
call fcn.00437610
push 0x4ed4d8
push 0x515408
call fcn.0048be90
add esp, 4
mov esi, esp
mov dword [ebp - 0x14], esi
mov ecx, dword [0x51537c]
lea ecx, [ecx - 0x10]
call fcn.0041c6e0
add eax, 0x10
mov dword [esi], eax
call fcn.00435630
cmp dword [0x5153a8], edi
jne 0x435adf
cmp dword [0x51536c], edi
je 0x435adf
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004358e0
cmp dword [0x5153a8], 0
jne 0x435af6
cmp dword [0x51536c], 0
jne 0x435acb
call fcn.004376a0
push 0
push 0
push 0x515368
push 0x435970
push 0
push 0
call fcn.004ae850
add esp, 0x18
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x4ed4e8
push 0x4b
call fcn.00437610
push str.Write_Regedit
push 0x515408
call fcn.0048be90
mov ecx, dword [0x5153a0]
xor edx, edx
mov edi, dword [0x51539c]
add esp, 8
sub ecx, edi
xor ebx, ebx
add ecx, 3
shr ecx, 2
cmp edi, dword [0x5153a0]
cmova ecx, edx
test ecx, ecx
je 0x435b72
mov esi, ecx
nop
mov ecx, dword [edi]
call fcn.0043866f
inc ebx
lea edi, [edi + 4]
cmp ebx, esi
jne 0x435b60
mov esi, dword [ebp - 0x10]
cmp dword [0x5153a8], 0
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jne 0x435b8e
cmp dword [0x51536c], 0
jne 0x435cbf
push 0x4ed504
push 0x50
call fcn.00437610
push str.InstallService
push 0x515408
call fcn.0048be90
add esp, 8
push 0x4ed520
push 0x5a
call fcn.00437610
call fcn.004356d0
cmp dword [0x5153a8], 0
jne 0x435bd3
cmp dword [0x51536c], 0
jne 0x435cbf
push 0x4ed52c
push 0x515408
call fcn.0048be90
add esp, 8
push 0xffffffffffffffff
push esi
call edi
test esi, esi
je 0x435bfa
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov dword [ebp - 0x10], esi
cmp dword [0x5153a8], 0
jne 0x435c10
cmp dword [0x51536c], 0
jne 0x435cbf
push 0x4ed550
push 0x62
call fcn.00437610
push 0x4ed55c
push 0x515408
call fcn.0048be90
push str.QQPCRTP.exe
mov edx, 0x51537c
lea ecx, [ebp - 0x14]
call fcn.0041c030
add esp, 0xc
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x14]
mov ebx, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x435c65
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
je 0x435ca1
push 0x43866a
push dword [0x5153a0]
lea ecx, [ebp - 0x14]
push dword [0x51539c]
call fcn.00438020
add esp, 0xc
lea ecx, [ebp - 0x14]
push 0x438674
push dword [0x5153a0]
push dword [0x51539c]
call fcn.00438020
add esp, 0xc
push str.WriteInstallTimer
push 0x515408
call fcn.0048be90
add esp, 8
call fcn.004373e0
mov ebx, 1
jmp 0x435cc1
xor ebx, ebx
test esi, esi
je 0x435cd1
push 0xffffffffffffffff
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret