Function at 0x407650
Capabilities:
Check if file exists
Create process on windows
Delete directory
Delete file
Delete registry key
Delete registry value
Get installed programs
Move file
Persist via lnk shortcut
Persist via run registry key
Query or enumerate registry value
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44cc92
mov eax, dword fs:[0]
push eax
sub esp, 0xe18
mov eax, dword [0x463444]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xe1c], ecx
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x674], 0
push 0x453af6
lea ecx, [ebp - 0x560]
call fcn.00402330
mov dword [ebp - 4], 0
mov dword [ebp - 0x870], 0
push 0x9c
push 0
lea eax, [ebp - 0x86c]
push eax
call fcn.0043b290
add esp, 0xc
mov dword [ebp - 0x86c], 0x9c
lea ecx, [ebp - 0x86c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x407703
mov dword [ebp - 0x86c], 0x94
lea edx, [ebp - 0x86c]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x85c], 1
jne 0x40771f
cmp dword [ebp - 0x868], 4
jne 0x40771f
mov dword [ebp - 0x870], 1
mov ecx, dword [ebp - 0xe1c]
call fcn.00406f20
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xe1c]
call fcn.00407110
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x334], 0
push 0x103
push 0
lea eax, [ebp - 0x333]
push eax
call fcn.0043b290
add esp, 0xc
mov byte [ebp - 0x22c], 0
push 0x103
push 0
lea ecx, [ebp - 0x22b]
push ecx
call fcn.0043b290
add esp, 0xc
mov byte [ebp - 0x43c], 0
push 0x103
push 0
lea edx, [ebp - 0x43b]
push edx
call fcn.0043b290
add esp, 0xc
mov byte [ebp - 0x66c], 0
push 0x103
push 0
lea eax, [ebp - 0x66b]
push eax
call fcn.0043b290
add esp, 0xc
mov dword [ebp - 0x670], 0x455960
mov dword [ebp - 0x7c8], 0
lea ecx, [ebp - 0x7c8]
push ecx
push 1
push 0
mov edx, dword [ebp - 0x670]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x4078a8
mov dword [ebp - 0x984], 0x104
mov dword [ebp - 0x980], 1
lea eax, [ebp - 0x984]
push eax
lea ecx, [ebp - 0x66c]
push ecx
lea edx, [ebp - 0x980]
push edx
push 0
push 0x45598c
mov eax, dword [ebp - 0x7c8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x674], eax
lea ecx, [ebp - 0x66c]
push ecx
lea edx, [ebp - 0x334]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x45599c
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x66c]
push ecx
lea edx, [ebp - 0x43c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4559a4
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x66c]
push ecx
lea edx, [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4559bc
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x44
push 0
lea ecx, [ebp - 0x7c4]
push ecx
call fcn.0043b290
add esp, 0xc
mov dword [ebp - 0x7c4], 0x44
xor edx, edx
mov dword [ebp - 0x450], edx
mov dword [ebp - 0x44c], edx
mov dword [ebp - 0x448], edx
mov dword [ebp - 0x444], edx
mov byte [ebp - 0x55c], 0
push 0x103
push 0
lea eax, [ebp - 0x55b]
push eax
call fcn.0043b290
add esp, 0xc
mov byte [ebp - 0x124], 0
push 0x103
push 0
lea ecx, [ebp - 0x123]
push ecx
call fcn.0043b290
add esp, 0xc
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0x55c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4559c4
lea ecx, [ebp - 0x55c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x55c]
push edx
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
lea ecx, [ebp - 0x55c]
push ecx
call fcn.00439966
add esp, 8
cmp eax, 0xffffffff
je 0x4079ef
push str.__t__u__s
lea edx, [ebp - 0x55c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x7c4]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x55c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4079ae
jmp 0x4079ef
push 0xffffffffffffffff
mov eax, dword [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x450]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x44c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x14], 0
jne 0x407ac7
mov byte [ebp - 0xa8c], 0
push 0x103
push 0
lea ecx, [ebp - 0xa8b]
push ecx
call fcn.0043b290
add esp, 0xc
lea edx, [ebp - 0x334]
push edx
lea eax, [ebp - 0xa8c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str._ngslotd.exe
lea ecx, [ebp - 0xa8c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea edx, [ebp - 0xa8c]
push edx
call fcn.00439966
add esp, 8
cmp eax, 0xffffffff
je 0x407ac7
push 0x4559f8
lea eax, [ebp - 0xa8c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x450]
push ecx
lea edx, [ebp - 0x7c4]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xa8c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x407a93
jmp 0x407ac7
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x450]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x450]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x44c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x670], 0x4559fc
lea ecx, [ebp - 0x7c8]
push ecx
push 0xf003f
push 0
mov edx, dword [ebp - 0x670]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x407b24
mov dword [ebp - 0x670], 0x455a2c
mov eax, dword [ebp - 0x670]
push eax
mov ecx, dword [ebp - 0x7c8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x670], str.SOFTWAREMicrosoftCryptographyDefaultsProvider
lea edx, [ebp - 0x7c8]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0x670]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x407b81
mov dword [ebp - 0x670], str.FEITIAN_ePassNG_RSA_Cryptographic_Service_Provider_For_QDCCB
mov ecx, dword [ebp - 0x670]
push ecx
mov edx, dword [ebp - 0x7c8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x670], str.SOFTWARENGSrvRef
lea eax, [ebp - 0x7c8]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp - 0x670]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x407fbb
lea ecx, [ebp - 0xbd8]
call fcn.00408aa0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xab0]
call fcn.00408aa0
mov byte [ebp - 4], 2
mov dword [ebp - 0xbc0], 0
mov byte [ebp - 0xbbc], 0
push 0x103
push 0
lea edx, [ebp - 0xbbb]
push edx
call fcn.0043b290
add esp, 0xc
mov dword [ebp - 0xa94], pe_nt_image_headers32
mov dword [ebp - 0xbdc], 4
mov dword [ebp - 0xa90], pe_nt_image_headers32
mov dword [ebp - 0xab4], 0
push 0x104
push 0
lea eax, [ebp - 0xbbc]
push eax
call fcn.0043b290
add esp, 0xc
lea ecx, [ebp - 0xa90]
push ecx
lea edx, [ebp - 0xa98]
push edx
lea eax, [ebp - 0xbdc]
push eax
push 0
lea ecx, [ebp - 0xa94]
push ecx
lea edx, [ebp - 0xbbc]
push edx
mov eax, dword [ebp - 0xbc0]
push eax
mov ecx, dword [ebp - 0x7c8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x407cf7
lea edx, [ebp - 0xbbc]
push edx
lea ecx, [ebp - 0xe10]
call fcn.00402330
mov byte [ebp - 4], 3
lea eax, [ebp - 0xe10]
push eax
lea ecx, [ebp - 0xbd8]
call fcn.00408a20
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xe10]
call fcn.00402f30
lea ecx, [ebp - 0xa98]
push ecx
lea ecx, [ebp - 0xab0]
call fcn.00408b30
mov edx, dword [ebp - 0xbc0]
add edx, 1
mov dword [ebp - 0xbc0], edx
mov dword [ebp - 0xa94], pe_nt_image_headers32
mov dword [ebp - 0xa90], pe_nt_image_headers32
jmp 0x407cf9
jmp 0x407d06
mov eax, 1
test eax, eax
jne 0x407c2b
mov dword [ebp - 0xbe0], 0
jmp 0x407d21
mov ecx, dword [ebp - 0xbe0]
add ecx, 1
mov dword [ebp - 0xbe0], ecx
mov edx, dword [ebp - 0xbe0]
cmp edx, dword [ebp - 0xbc0]
jae 0x407f9d
push 0x453af7
lea ecx, [ebp - 0xbe4]
call fcn.00402330
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xbe0]
push eax
lea ecx, [ebp - 0xbd8]
call fcn.004089f0
push eax
lea ecx, [ebp - 0xbe4]
call fcn.00402980
push 0
push str.ngsrv_ngslotd.exe
lea ecx, [ebp - 0xbe4]
call fcn.00401a40
cmp eax, 0xffffffff
je 0x407d96
cmp dword [ebp - 0x14], 0
jne 0x407d96
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xbe4]
call fcn.00402f30
jmp 0x407d12
push 0x5c
lea ecx, [ebp - 0xbe4]
call fcn.00408890
mov dword [ebp - 0x440], eax
lea ecx, [ebp - 0xbe4]
call fcn.00402a10
sub eax, dword [ebp - 0x440]
sub eax, 1
push eax
lea ecx, [ebp - 0xbe8]
push ecx
lea ecx, [ebp - 0xbe4]
call fcn.00401ac0
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0xe14], esp
lea edx, [ebp - 0xbe8]
push edx
call fcn.00403190
mov dword [ebp - 0xe20], eax
mov ecx, dword [ebp - 0xe1c]
call fcn.004075e0
mov dword [ebp - 0xe24], eax
cmp dword [ebp - 0xe24], 0
je 0x407f06
push 0x80
mov eax, dword [ebp - 0xbe0]
push eax
lea ecx, [ebp - 0xbd8]
call fcn.004089f0
mov ecx, eax
call fcn.0040dcb0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [ebp - 0xbe0]
push ecx
lea ecx, [ebp - 0xbd8]
call fcn.004089f0
mov ecx, eax
call fcn.0040dcb0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0xab4], eax
cmp dword [ebp - 0xab4], 0
jne 0x407ed7
push 0x455ae0
mov edx, dword [ebp - 0xbe0]
push edx
lea ecx, [ebp - 0xbd8]
call fcn.004089f0
push eax
lea eax, [ebp - 0xbec]
push eax
call fcn.004088e0
add esp, 0xc
push 1
lea ecx, [ebp - 0xbec]
call fcn.0040dcb0
push eax
mov ecx, dword [ebp - 0xbe0]
push ecx
lea ecx, [ebp - 0xbd8]
call fcn.004089f0
mov ecx, eax
call fcn.0040dcb0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
push 0
lea ecx, [ebp - 0xbec]
call fcn.0040dcb0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [ebp - 0xbec]
call fcn.00402f30
mov edx, dword [ebp - 0xbe0]
push edx
lea ecx, [ebp - 0xbd8]
call fcn.004089f0
mov ecx, eax
call fcn.0040dcb0
push eax
mov eax, dword [ebp - 0x7c8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x674], eax
jmp 0x407f7a
cmp dword [ebp - 0x10], 0
je 0x407f7a
mov ecx, dword [ebp - 0xbe0]
push ecx
lea ecx, [ebp - 0xab0]
call fcn.004089f0
cmp dword [eax], 1
jbe 0x407f7a
mov edx, dword [ebp - 0xbe0]
push edx
lea ecx, [ebp - 0xab0]
call fcn.004089f0
mov eax, dword [eax]
sub eax, 1
mov dword [ebp - 0xbf0], eax
push 4
lea ecx, [ebp - 0xbf0]
push ecx
push 4
push 0
mov edx, dword [ebp - 0xbe0]
push edx
lea ecx, [ebp - 0xbd8]
call fcn.004089f0
mov ecx, eax
call fcn.0040dcb0
push eax
mov eax, dword [ebp - 0x7c8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x674], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xbe8]
call fcn.00402f30
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xbe4]
call fcn.00402f30
jmp 0x407d12
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xab0]
call fcn.00408b10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xbd8]
call fcn.004089d0
mov dword [ebp - 0x670], str.SOFTWARENGSrvProduct
lea ecx, [ebp - 0x7c8]
push ecx
push 0xf003f
push 0
mov edx, dword [ebp - 0x670]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x408018
mov dword [ebp - 0x670], str.5B337642_D80A_4a5c_889C_B6E09920F702_FT11_QDCCB
mov eax, dword [ebp - 0x670]
push eax
mov ecx, dword [ebp - 0x7c8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x14], 0
jne 0x4080a3
mov dword [ebp - 0x670], str.SOFTWARENGSrv
lea edx, [ebp - 0x7c8]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0x670]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x4080a3
mov dword [ebp - 0x670], str.Product
mov ecx, dword [ebp - 0x670]
push ecx
mov edx, dword [ebp - 0x7c8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x670], 0x455b44
mov eax, dword [ebp - 0x670]
push eax
mov ecx, dword [ebp - 0x7c8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x670], str.SOFTWAREqdccb
lea edx, [ebp - 0x7c8]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0x670]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x40818b
mov dword [ebp - 0x670], str.ePass2000_FT11
mov ecx, dword [ebp - 0x670]
push ecx
mov edx, dword [ebp - 0x7c8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x670], str.SOFTWARE
lea eax, [ebp - 0x7c8]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp - 0x670]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x40818b
mov dword [ebp - 0x670], str.qdccb
mov edx, dword [ebp - 0x670]
push edx
mov eax, dword [ebp - 0x7c8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x14], 0
jne 0x40818b
mov dword [ebp - 0x670], str.NGSrv
mov ecx, dword [ebp - 0x670]
push ecx
mov edx, dword [ebp - 0x7c8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x670], str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea eax, [ebp - 0x7c8]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp - 0x670]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x4081e8
mov dword [ebp - 0x670], 0x455bb8
mov edx, dword [ebp - 0x670]
push edx
mov eax, dword [ebp - 0x7c8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x14], 0
jne 0x408200
lea ecx, [ebp - 0x334]
push ecx
mov ecx, dword [ebp - 0xe1c]
call fcn.004073a0
lea edx, [ebp - 0x77c]
push edx
mov ecx, dword [ebp - 0xe1c]
call fcn.00406590
mov byte [ebp - 0x97c], 0
push 0x103
push 0
lea eax, [ebp - 0x97b]
push eax
call fcn.0043b290
add esp, 0xc
lea ecx, [ebp - 0x77c]
push ecx
lea edx, [ebp - 0x97c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.qdccbePass2000_FT11FT11qdccb.dat
lea eax, [ebp - 0x97c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x97c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x408273
lea edx, [ebp - 0x97c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
push 0
lea eax, [ebp - 0x97c]
push eax
call fcn.0043b290
add esp, 0xc
lea ecx, [ebp - 0x77c]
push ecx
lea edx, [ebp - 0x97c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.qdccbePass2000_FT11uninst.exe
lea eax, [ebp - 0x97c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x97c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4082cd
lea edx, [ebp - 0x97c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
push 0
lea eax, [ebp - 0x97c]
push eax
call fcn.0043b290
add esp, 0xc
lea ecx, [ebp - 0x77c]
push ecx
lea edx, [ebp - 0x97c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.qdccbePass2000_FT11
lea eax, [ebp - 0x97c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x97c]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x104
push 0
lea edx, [ebp - 0x97c]
push edx
call fcn.0043b290
add esp, 0xc
lea eax, [ebp - 0x77c]
push eax
lea ecx, [ebp - 0x97c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.qdccd
lea edx, [ebp - 0x97c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x97c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [ebp - 0x670], str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [ebp - 0x7c8]
push ecx
push 0x20019
push 0
mov edx, dword [ebp - 0x670]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x408841
mov byte [ebp - 0xcfc], 0
push 0x103
push 0
lea eax, [ebp - 0xcfb]
push eax
call fcn.0043b290
add esp, 0xc
mov dword [ebp - 0xd00], 0x104
lea ecx, [ebp - 0xd00]
push ecx
lea edx, [ebp - 0xcfc]
push edx
push 0
push 0
push str.Common_Programs
mov eax, dword [ebp - 0x7c8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x40883f
mov byte [ebp - 0xe0c], 0
push 0x103
push 0
lea ecx, [ebp - 0xe0b]
push ecx
call fcn.0043b290
add esp, 0xc
mov edx, dword [ebp - 0xd00]
push edx
lea eax, [ebp - 0xcfc]
push eax
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.0043cf50
add esp, 0xc
push str.Feitian_
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x408464
lea ecx, [ebp - 0xe0c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
push 0
lea edx, [ebp - 0xe0c]
push edx
call fcn.0043b290
add esp, 0xc
mov eax, dword [ebp - 0xd00]
push eax
lea ecx, [ebp - 0xcfc]
push ecx
lea edx, [ebp - 0xe0c]
push edx
call fcn.0043cf50
add esp, 0xc
push 0x455ce4
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0xe0c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4084c7
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
push 0
lea eax, [ebp - 0xe0c]
push eax
call fcn.0043b290
add esp, 0xc
mov ecx, dword [ebp - 0xd00]
push ecx
lea edx, [ebp - 0xcfc]
push edx
lea eax, [ebp - 0xe0c]
push eax
call fcn.0043cf50
add esp, 0xc
push 0x455d10
lea ecx, [ebp - 0xe0c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40852a
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
push 0
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.0043b290
add esp, 0xc
mov edx, dword [ebp - 0xd00]
push edx
lea eax, [ebp - 0xcfc]
push eax
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.0043cf50
add esp, 0xc
push str.The_Certificate_Manager_for_QDCCBQDCCB_UKey_DriverUninstallQDCCB_UKey_Driver.lnk
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40858d
lea ecx, [ebp - 0xe0c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
push 0
lea edx, [ebp - 0xe0c]
push edx
call fcn.0043b290
add esp, 0xc
mov eax, dword [ebp - 0xd00]
push eax
lea ecx, [ebp - 0xcfc]
push ecx
lea edx, [ebp - 0xe0c]
push edx
call fcn.0043cf50
add esp, 0xc
push str.FeitianQDCCB_UKey_DriverUninstallQDCCB_UKey_Driver.lnk
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0xe0c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4085f0
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
push 0
lea eax, [ebp - 0xe0c]
push eax
call fcn.0043b290
add esp, 0xc
mov ecx, dword [ebp - 0xd00]
push ecx
lea edx, [ebp - 0xcfc]
push edx
lea eax, [ebp - 0xe0c]
push eax
call fcn.0043cf50
add esp, 0xc
push str.FeitianePass2000UninstallePass2000.lnk
lea ecx, [ebp - 0xe0c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x408653
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
push 0
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.0043b290
add esp, 0xc
mov edx, dword [ebp - 0xd00]
push edx
lea eax, [ebp - 0xcfc]
push eax
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.0043cf50
add esp, 0xc
push 0x455e18
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x104
push 0
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.0043b290
add esp, 0xc
mov edx, dword [ebp - 0xd00]
push edx
lea eax, [ebp - 0xcfc]
push eax
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.0043cf50
add esp, 0xc
push 0x455e4c
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x104
push 0
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.0043b290
add esp, 0xc
mov edx, dword [ebp - 0xd00]
push edx
lea eax, [ebp - 0xcfc]
push eax
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.0043cf50
add esp, 0xc
push 0x455e7c
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x104
push 0
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.0043b290
add esp, 0xc
mov edx, dword [ebp - 0xd00]
push edx
lea eax, [ebp - 0xcfc]
push eax
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.0043cf50
add esp, 0xc
push str.FeitianePass2000
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x104
push 0
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.0043b290
add esp, 0xc
mov edx, dword [ebp - 0xd00]
push edx
lea eax, [ebp - 0xcfc]
push eax
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.0043cf50
add esp, 0xc
push str.FeitianQDCCB_UKey_Driver
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x104
push 0
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.0043b290
add esp, 0xc
mov edx, dword [ebp - 0xd00]
push edx
lea eax, [ebp - 0xcfc]
push eax
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.0043cf50
add esp, 0xc
push str.Feitian
lea edx, [ebp - 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x40884e
mov ecx, dword [ebp - 0x7c8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xe18], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x560]
call fcn.00402f30
mov eax, dword [ebp - 0xe18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004381fb
mov esp, ebp
pop ebp
ret