Function at 0x413ee0
Capabilities:
Contain obfuscated stackstrings
Delete registry key
Get common file path
Get startup folder
Move file
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474b18
mov eax, dword fs:[0]
push eax
sub esp, 0xb54
mov eax, dword [0x498068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xaac], ecx
xor ebx, ebx
lea ecx, [ebp - 0xaa8]
mov dword [ebp - 0xaa4], ebx
mov dword [ebp - 0xaa8], ebx
call fcn.00404820
mov esi, dword [ebp - 0xaa8]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x49ad28], ebx
jg 0x413fac
sub esp, 8
mov dword [ebp - 0xb60], ebx
lea ecx, [ebp - 0xb58]
call fcn.004235a0
mov dword [ebp - 0xabc], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab8], 0x9a
call edi
push 0x9a
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xab4], eax
call fcn.00426000
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0xb58]
mov ebx, 1
mov edx, str.doDeleteQPFiles____product_count:
push esi
mov dword [ebp - 0xaa4], ebx
call fcn.00407b40
mov ecx, eax
call fcn.00405ad0
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x413fcc
and ebx, 0xfffffffe
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xaa4], ebx
call fcn.00425b00
cmp esi, 1
ja 0x416eb9
call fcn.004050b0
test eax, eax
jne 0x416eb9
push dword [ebp - 0xaac]
lea ecx, [ebp - 0x9c8]
call fcn.00401920
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x890]
push 0xd
xor eax, eax
mov dword [ebp - 0x880], 0
mov dword [ebp - 0x87c], 0
push str.BinQQProtect
mov dword [ebp - 0x880], 0
mov dword [ebp - 0x87c], 7
mov word [ebp - 0x890], ax
call fcn.00401a50
lea eax, [ebp - 0x890]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x9c8]
call fcn.00427150
lea ecx, [ebp - 0x9c8]
mov byte [ebp - 4], 4
cmp ecx, eax
je 0x414081
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x414072
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x9c8]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 3
call fcn.00401850
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x87c]
cmp edx, 8
jb 0x4140d4
mov ecx, dword [ebp - 0x890]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4140ca
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416f66
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x880], 0
mov dword [ebp - 0x87c], 7
mov word [ebp - 0x890], ax
mov dl, 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9c8]
call fcn.00427e90
mov byte [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x8c8], 0
mov dword [ebp - 0x8c4], 0
mov dword [ebp - 0x8c8], 0
mov dword [ebp - 0x8c4], 7
mov word [ebp - 0x8d8], ax
push 0x208
push eax
lea eax, [ebp - 0x830]
mov byte [ebp - 4], 0xa
push eax
call fcn.00452a30
add esp, 0xc
lea eax, [ebp - 0x830]
push 0
push 0x2b
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x830]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414170
sub ecx, edx
lea eax, [ebp - 0x830]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x8d8]
call fcn.00401a50
lea eax, [ebp - 0x8d8]
push eax
lea ecx, [ebp - 0x920]
call fcn.00401920
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x878]
push 9
xor eax, eax
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x864], 0
push str.QQProtect
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x864], 7
mov word [ebp - 0x878], ax
call fcn.00401a50
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x890]
push 7
xor eax, eax
mov dword [ebp - 0x880], 0
mov dword [ebp - 0x87c], 0
push 0x484908
mov dword [ebp - 0x880], 0
mov dword [ebp - 0x87c], 7
mov word [ebp - 0x890], ax
call fcn.00401a50
lea eax, [ebp - 0x890]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0xa28]
push eax
lea ecx, [ebp - 0x920]
call fcn.00427150
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], 0xe
push ecx
lea ecx, [ebp - 0x8a8]
push ecx
mov ecx, eax
call fcn.00427150
lea ecx, [ebp - 0x920]
mov byte [ebp - 4], 0xf
cmp ecx, eax
je 0x41428f
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x414280
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x920]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0xe
call fcn.00401850
lea ecx, [ebp - 0xa28]
mov byte [ebp - 4], 0xd
call fcn.00401850
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x87c]
cmp edx, 8
jb 0x4142f1
mov ecx, dword [ebp - 0x890]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4142e7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416f6b
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x880], 0
mov dword [ebp - 0x87c], 7
mov word [ebp - 0x890], ax
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x864]
cmp edx, 8
jb 0x414352
mov ecx, dword [ebp - 0x878]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414348
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416f70
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x864], 7
mov word [ebp - 0x878], ax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x860]
push 0x11
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], eax
push str.BinQQProtect.exe
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
call fcn.00401a50
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x9b0]
push eax
lea ecx, [ebp - 0x920]
call fcn.00427150
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x84c]
cmp edx, 8
jb 0x414409
mov ecx, dword [ebp - 0x860]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4143ff
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416f75
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
mov byte [ebp - 4], 0x1a
call fcn.004136e0
cmp dword [0x49ad28], 0
mov esi, eax
jg 0x4144a8
sub esp, 8
mov dword [ebp - 0xb60], 0
lea ecx, [ebp - 0xb58]
call fcn.004235a0
mov dword [ebp - 0xabc], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab8], 0xb3
call edi
push 0xb3
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xab4], eax
call fcn.00426000
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xb58]
or ebx, 4
mov edx, str.remove_qpcore:
push esi
mov dword [ebp - 0xaa4], ebx
call fcn.00407b40
mov ecx, eax
call fcn.00405ad0
mov dword [ebp - 4], 0x1a
test bl, 4
je 0x4144c8
and ebx, 0xfffffffb
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xaa4], ebx
call fcn.00425b00
lea eax, [ebp - 0x9b0]
push eax
lea ecx, [ebp - 0x848]
call fcn.00429760
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x860]
push 2
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
push 0x48497c
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0xf
mov byte [ebp - 0x860], 0
call fcn.004069a0
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x848]
call fcn.0042a320
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x84c]
cmp edx, 0x10
jb 0x414573
mov ecx, dword [ebp - 0x860]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x414569
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416f7a
push edx
push ecx
call fcn.004501a5
add esp, 8
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0xf
mov byte [ebp - 0x860], 0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x878]
push 9
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x864], 0
push str._utqpcore
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x864], 0xf
mov byte [ebp - 0x878], 0
call fcn.004069a0
lea eax, [ebp - 0x878]
mov byte [ebp - 4], 0x26
push eax
lea ecx, [ebp - 0x848]
call fcn.0042a320
mov byte [ebp - 4], 0x27
mov edx, dword [ebp - 0x864]
cmp edx, 0x10
jb 0x414627
mov ecx, dword [ebp - 0x878]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41461d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416f7f
push edx
push ecx
call fcn.004501a5
add esp, 8
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x864], 0xf
mov byte [ebp - 0x878], 0
mov byte [ebp - 4], 0x20
cmp dword [0x49ad28], 2
jg 0x4146cd
sub esp, 8
mov dword [ebp - 0xb60], 2
lea ecx, [ebp - 0xb58]
call fcn.004235a0
mov dword [ebp - 0xabc], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab8], 0xba
call edi
push 0xba
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xab4], eax
call fcn.00426000
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0xb58]
or ebx, 8
mov edx, str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
push 0xba
mov dword [ebp - 0xaa4], ebx
call fcn.00407b40
mov ecx, eax
call fcn.00405e10
mov edx, str._utqpcore__3
mov ecx, eax
call fcn.00407b40
mov dword [ebp - 4], 0x20
test bl, 8
je 0x4146ed
and ebx, 0xfffffff7
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xaa4], ebx
call fcn.00425b00
cmp dword [0x49ad28], 0
jg 0x414787
sub esp, 8
mov dword [ebp - 0xb60], 0
lea ecx, [ebp - 0xb58]
call fcn.004235a0
mov dword [ebp - 0xabc], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab8], 0xbb
call edi
push 0xbb
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xab4], eax
call fcn.00426000
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0xb58]
or ebx, 0x10
mov edx, str.UnInstall_
mov dword [ebp - 0xaa4], ebx
call fcn.00407b40
cmp dword [ebp - 0x99c], 8
lea edx, [ebp - 0x9b0]
mov ecx, eax
cmovae edx, dword [ebp - 0x9b0]
call fcn.004263f0
mov edx, 0x48794c
mov ecx, eax
call fcn.00407b40
mov dword [ebp - 4], 0x20
test bl, 0x10
je 0x4147a7
and ebx, 0xffffffef
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xaa4], ebx
call fcn.00425b00
lea eax, [ebp - 0xaa8]
mov dword [ebp - 0xab0], 0
push eax
lea edx, [ebp - 0x888]
mov word [ebp - 0x887], 0
lea ecx, [ebp - 0x848]
mov dword [ebp - 0x884], 0
mov byte [ebp - 0x880], 0
mov dword [ebp - 0x87c], 0
mov byte [ebp - 0x888], 1
mov dword [ebp - 0xaa8], 0
call fcn.004245e0
add esp, 4
test al, al
je 0x4148ed
mov esi, dword [ebp - 0xaa8]
push 0xea60
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x414879
cmp dword [0x49ad28], 2
jg 0x414868
push 2
push 0xc3
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb60]
call fcn.00425970
mov byte [ebp - 4], 0x2d
lea ecx, [eax + 8]
or ebx, 0x20
push 0xc3
mov dword [ebp - 0xaa4], ebx
call fcn.00405e10
mov edx, str.wait_qqprotect_exit_timeout_
mov ecx, eax
call fcn.00407b40
mov dword [ebp - 4], 0x20
test bl, 0x20
je 0x4148ed
and ebx, 0xffffffdf
jmp 0x4148dc
lea edx, [ebp - 0xab0]
mov ecx, esi
call fcn.00424680
cmp dword [0x49ad28], 0
jg 0x4148cd
push 0
push 0xc6
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb60]
call fcn.00425970
mov byte [ebp - 4], 0x2e
lea ecx, [eax + 8]
push dword [ebp - 0xab0]
or ebx, 0x40
mov edx, str._3__utqpcore:
mov dword [ebp - 0xaa4], ebx
call fcn.00407b40
mov ecx, eax
call fcn.00405e10
mov dword [ebp - 4], 0x20
test bl, 0x40
je 0x4148ed
and ebx, 0xffffffbf
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xaa4], ebx
call fcn.00425b00
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x83c]
mov esi, dword [ebp - 0x83c]
push dword [esi + 4]
call fcn.0042a6f0
mov eax, dword [ebp - 0x83c]
push 0x40
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x83c]
mov dword [eax], esi
mov eax, dword [ebp - 0x83c]
mov dword [eax + 8], esi
push dword [ebp - 0x83c]
mov dword [ebp - 0x838], 0
call fcn.004501a5
add esp, 8
lea ecx, [ebp - 0x848]
call fcn.00419cb0
mov dl, 1
lea ecx, [ebp - 0x920]
call fcn.00427e90
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00452a30
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp dword [0x49ad14], 1
jne 0x4149c6
cmp dword [0x49ad28], 3
jg 0x4149c6
test eax, eax
je 0x4149c6
push 3
push 0xd2
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb60]
call fcn.00425970
or ebx, 0x80
mov byte [ebp - 4], 0x2f
lea ecx, [eax + 8]
mov dword [ebp - 0xaa4], ebx
mov edx, str.Check_failed:_hr__S_OK.
call fcn.00407b40
mov dword [ebp - 4], 0x1a
test bl, bl
jns 0x4149e8
and ebx, 0xffffff7f
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xaa4], ebx
call fcn.00425b00
xor eax, eax
mov dword [ebp - 0x838], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x838], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414a22
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x848]
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0x30
push eax
lea ecx, [ebp - 0x998]
call fcn.00401920
mov byte [ebp - 4], 0x33
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x414a9e
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414a94
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416f84
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x860]
push 0x17
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], eax
push str.TencentQQProtectQScan
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
call fcn.00401a50
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0x37
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x998]
call fcn.00427150
lea ecx, [ebp - 0x998]
mov byte [ebp - 4], 0x38
cmp ecx, eax
je 0x414b38
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x414b29
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x998]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x37
call fcn.00401850
mov byte [ebp - 4], 0x39
mov edx, dword [ebp - 0x84c]
cmp edx, 8
jb 0x414b8b
mov ecx, dword [ebp - 0x860]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414b81
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416f89
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
mov byte [ebp - 4], 0x32
xor esi, esi
mov dword [ebp - 0x888], str.QScanEngine.dll
mov dword [ebp - 0x884], str.config.dat
mov dword [ebp - 0x880], str.sig.dat
mov dword [ebp - 0x87c], str.QSLSig.dat
nop word [eax + eax]
lea eax, [ebp - 0x998]
push eax
lea ecx, [ebp - 0x860]
call fcn.00401920
mov byte [ebp - 4], 0x3d
xor eax, eax
mov edx, dword [ebp + esi*4 - 0x888]
mov ecx, edx
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
lea edi, [ecx + 2]
mov word [ebp - 0x848], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414c33
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x848]
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0x3e
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x860]
call fcn.00427150
lea ecx, [ebp - 0x860]
mov byte [ebp - 4], 0x3f
cmp ecx, eax
je 0x414c93
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x414c84
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x860]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x3e
call fcn.00401850
mov byte [ebp - 4], 0x40
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x414ce6
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414cdc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416f66
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
xor dl, dl
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x860]
call fcn.00427e90
lea ecx, [ebp - 0x860]
mov byte [ebp - 4], 0x32
call fcn.00401850
inc esi
cmp esi, 4
jb 0x414be0
mov esi, dword [ebp - 0xaac]
lea ecx, [ebp - 0x890]
push esi
call fcn.00401920
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x848]
push 3
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
push 0x486364
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0x45
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x890]
call fcn.00427150
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], 0x46
cmp ecx, eax
je 0x414dca
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x414dbb
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x890]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x45
call fcn.00401850
mov byte [ebp - 4], 0x47
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x414e1d
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414e13
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416f8e
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
lea eax, [ebp - 0x890]
mov byte [ebp - 4], 0x44
push eax
lea ecx, [ebp - 0x980]
call fcn.00401920
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x860]
push 0xf
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
push str.QScanEngine.dll
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
call fcn.00401a50
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0x4c
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x980]
call fcn.00427150
lea ecx, [ebp - 0x980]
mov byte [ebp - 4], 0x4d
cmp ecx, eax
je 0x414edb
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x414ecc
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x980]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x4c
call fcn.00401850
mov byte [ebp - 4], 0x4e
mov edx, dword [ebp - 0x84c]
cmp edx, 8
jb 0x414f2e
mov ecx, dword [ebp - 0x860]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414f24
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416f93
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
xor dl, dl
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x980]
call fcn.00427e90
lea eax, [ebp - 0x890]
push eax
lea ecx, [ebp - 0x968]
call fcn.00401920
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x848]
push 0xb
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
push str.QSLogic.dll
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0x53
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x968]
call fcn.00427150
lea ecx, [ebp - 0x968]
mov byte [ebp - 4], 0x54
cmp ecx, eax
je 0x414ff9
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x414fea
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x968]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x53
call fcn.00401850
mov byte [ebp - 4], 0x55
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x41504c
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415042
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416f98
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
xor dl, dl
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x968]
call fcn.00427e90
push esi
lea ecx, [ebp - 0x908]
call fcn.00401920
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x860]
push 4
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
push str.Misc
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
call fcn.00401a50
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0x5a
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x908]
call fcn.00427150
lea ecx, [ebp - 0x908]
mov byte [ebp - 4], 0x5b
cmp ecx, eax
je 0x415111
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x415102
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x908]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x5a
call fcn.00401850
mov byte [ebp - 4], 0x5c
mov edx, dword [ebp - 0x84c]
cmp edx, 8
jb 0x415164
mov ecx, dword [ebp - 0x860]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41515a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416f9d
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
lea eax, [ebp - 0x908]
mov byte [ebp - 4], 0x59
push eax
lea ecx, [ebp - 0x8f0]
call fcn.00401920
mov byte [ebp - 4], 0x60
lea ecx, [ebp - 0x848]
push 5
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
push str.QScan
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0x61
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x8f0]
call fcn.00427150
lea ecx, [ebp - 0x8f0]
mov byte [ebp - 4], 0x62
cmp ecx, eax
je 0x415222
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x415213
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x8f0]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x61
call fcn.00401850
mov byte [ebp - 4], 0x63
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x415275
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41526b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416fa2
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
lea eax, [ebp - 0x8f0]
mov byte [ebp - 4], 0x60
push eax
lea ecx, [ebp - 0x950]
call fcn.00401920
mov byte [ebp - 4], 0x67
lea ecx, [ebp - 0x860]
push 0xa
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
push str.config.dat
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
call fcn.00401a50
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0x68
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x950]
call fcn.00427150
lea ecx, [ebp - 0x950]
mov byte [ebp - 4], 0x69
cmp ecx, eax
je 0x415333
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x415324
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x950]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x68
call fcn.00401850
mov byte [ebp - 4], 0x6a
mov edx, dword [ebp - 0x84c]
cmp edx, 8
jb 0x415386
mov ecx, dword [ebp - 0x860]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41537c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416fa7
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
xor dl, dl
mov byte [ebp - 4], 0x67
lea ecx, [ebp - 0x950]
call fcn.00427e90
lea eax, [ebp - 0x8f0]
push eax
lea ecx, [ebp - 0x938]
call fcn.00401920
mov byte [ebp - 4], 0x6e
lea ecx, [ebp - 0x848]
push 7
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
push str.sig.dat
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0x6f
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x938]
call fcn.00427150
lea ecx, [ebp - 0x938]
mov byte [ebp - 4], 0x70
cmp ecx, eax
je 0x415451
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x415442
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x938]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x6f
call fcn.00401850
mov byte [ebp - 4], 0x71
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x4154a4
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41549a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416fac
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
xor dl, dl
mov byte [ebp - 4], 0x6e
lea ecx, [ebp - 0x938]
call fcn.00427e90
lea eax, [ebp - 0x8f0]
push eax
lea ecx, [ebp - 0x9f8]
call fcn.00401920
mov byte [ebp - 4], 0x75
lea ecx, [ebp - 0x860]
push 0xa
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
push str.QSLSig.dat
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
call fcn.00401a50
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0x76
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x9f8]
call fcn.00427150
lea ecx, [ebp - 0x9f8]
mov byte [ebp - 4], 0x77
cmp ecx, eax
je 0x41556f
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x415560
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x9f8]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x76
call fcn.00401850
mov byte [ebp - 4], 0x78
mov edx, dword [ebp - 0x84c]
cmp edx, 8
jb 0x4155c2
mov ecx, dword [ebp - 0x860]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4155b8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416fb1
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
xor dl, dl
mov byte [ebp - 4], 0x75
lea ecx, [ebp - 0x9f8]
call fcn.00427e90
xor dl, dl
lea ecx, [ebp - 0x8f0]
call fcn.00427e90
xor dl, dl
lea ecx, [ebp - 0x908]
call fcn.00427e90
push 0x18
xor eax, eax
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x864], 0
lea ecx, [ebp - 0x878]
push str.TencentQQProtectAuTemp
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x864], 7
mov word [ebp - 0x878], ax
call fcn.00401a50
mov byte [ebp - 4], 0x7c
lea ecx, [ebp - 0x218]
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415690
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x848]
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0x7d
push eax
lea ecx, [ebp - 0x8c0]
call fcn.00401920
lea eax, [ebp - 0x878]
mov byte [ebp - 4], 0x7e
push eax
lea eax, [ebp - 0xa88]
push eax
lea ecx, [ebp - 0x8c0]
call fcn.00427150
lea ecx, [ebp - 0x8c0]
mov byte [ebp - 4], 0x80
call fcn.00401850
mov byte [ebp - 4], 0x82
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x415738
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41572e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416fb6
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
mov byte [ebp - 4], 0x87
mov edx, dword [ebp - 0x864]
cmp edx, 8
jb 0x415799
mov ecx, dword [ebp - 0x878]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41578f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416fbb
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x864], 7
mov word [ebp - 0x878], ax
mov dl, 1
mov byte [ebp - 4], 0x86
lea ecx, [ebp - 0xa88]
call fcn.00427e90
push 0x19
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
lea ecx, [ebp - 0x860]
push str.TencentQQProtect_atf.dat
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
call fcn.00401a50
mov byte [ebp - 4], 0x8b
lea ecx, [ebp - 0x218]
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415850
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x848]
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0x8c
push eax
lea ecx, [ebp - 0x8c0]
call fcn.00401920
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0x8d
push eax
lea eax, [ebp - 0xa70]
push eax
lea ecx, [ebp - 0x8c0]
call fcn.00427150
lea ecx, [ebp - 0x8c0]
mov byte [ebp - 4], 0x8f
call fcn.00401850
mov byte [ebp - 4], 0x91
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x4158f8
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4158ee
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416fc0
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
mov byte [ebp - 4], 0x96
mov edx, dword [ebp - 0x84c]
cmp edx, 8
jb 0x415959
mov ecx, dword [ebp - 0x860]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41594f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416fc5
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
xor dl, dl
mov byte [ebp - 4], 0x95
lea ecx, [ebp - 0xa70]
call fcn.00427e90
lea ecx, [ebp - 0xa40]
call fcn.00401900
mov byte [ebp - 4], 0x9a
cmp dword [0x49badc], 0
jne 0x4159d3
push 0x28
call fcn.00450175
add esp, 4
mov ecx, eax
call fcn.00425160
push 0
mov esi, eax
push esi
push 0x49badc
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4159d3
test esi, esi
je 0x4159d3
push 0x28
push esi
call fcn.004501a5
add esp, 8
mov eax, dword [0x49badc]
cmp dword [eax + 0x24], 1
jne 0x415d1b
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00452a30
add esp, 0xc
lea eax, [ebp - 0x628]
push 0
push 0x25
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x415c64
xor eax, eax
mov dword [ebp - 0x838], 0
lea ecx, [ebp - 0x628]
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x838], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415a53
sub ecx, edx
lea eax, [ebp - 0x628]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x848]
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0x9b
push eax
lea ecx, [ebp - 0x9e0]
call fcn.00401920
lea eax, [ebp - 0x8a8]
mov byte [ebp - 4], 0x9c
push eax
lea ecx, [ebp - 0x9e0]
call fcn.00427430
push eax
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], 0x9d
call fcn.00401920
lea ecx, [ebp - 0x878]
call fcn.00427330
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x9f
call fcn.00401850
lea ecx, [ebp - 0x9e0]
mov byte [ebp - 4], 0xa0
call fcn.00401850
lea ecx, [ebp - 0x848]
mov byte [ebp - 4], 0xa1
call fcn.00401850
push 0x18
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
lea ecx, [ebp - 0x860]
push str.driversQQProtectX64.sys
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
call fcn.00401a50
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0xa2
push eax
lea eax, [ebp - 0x8c0]
push eax
lea ecx, [ebp - 0x878]
call fcn.00427150
lea ecx, [ebp - 0x860]
mov byte [ebp - 4], 0xa4
call fcn.00401850
mov eax, dword [0x49aca8]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x415b83
push str.kernel32.dll
call edi
push str.Wow64EnableWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49aca8], eax
test eax, eax
je 0x415b87
push 0
call eax
xor dl, dl
lea ecx, [ebp - 0x8c0]
call fcn.00427e90
test al, al
jne 0x415c1d
cmp dword [0x49ad28], 0
jg 0x415bd9
push 0
push 0x119
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb60]
call fcn.00425970
or ebx, 0x100
mov byte [ebp - 4], 0xa5
lea ecx, [eax + 8]
mov dword [ebp - 0xaa4], ebx
mov edx, str.delete_qqprotectx64.sys_after_reboot_
call fcn.00407b40
mov dword [ebp - 4], 0xa4
test ebx, 0x100
je 0x415bff
and ebx, 0xfffffeff
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xaa4], ebx
call fcn.00425b00
lea ecx, [ebp - 0x8c0]
call fcn.00406940
cmp eax, 0x104
jae 0x415c1d
push 5
push 0
call fcn.00401810
push eax
call esi
mov eax, dword [0x49aca8]
test eax, eax
jne 0x415c42
push str.kernel32.dll
call edi
push str.Wow64EnableWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49aca8], eax
test eax, eax
je 0x415c46
push 1
call eax
lea ecx, [ebp - 0x8c0]
mov byte [ebp - 4], 0xa1
call fcn.00401850
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], 0x9a
call fcn.00401850
push str.SYSTEMCurrentControlSetServicesQQProtectX64
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [0x49ad28], 0
jg 0x415cec
sub esp, 8
mov dword [ebp - 0xb60], 0
lea ecx, [ebp - 0xb58]
call fcn.004235a0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xabc], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab8], 0x120
call edi
push 0x120
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xab4], eax
call fcn.00426000
or ebx, 0x200
mov byte [ebp - 4], 0xa6
mov edx, str.deleted:_SYSTEMCurrentControlSetServicesQQProtectX64
mov dword [ebp - 0xaa4], ebx
lea ecx, [ebp - 0xb58]
call fcn.00407b40
mov dword [ebp - 4], 0x9a
test ebx, 0x200
je 0x4161db
and ebx, 0xfffffdff
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xaa4], ebx
call fcn.00425b00
jmp 0x4161db
lea edx, [ebp - 0xa40]
mov ecx, 0x66
call fcn.0042c0b0
push 0x15
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
lea ecx, [ebp - 0x848]
push str.driversQQProtect.sys
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0xa7
push eax
lea eax, [ebp - 0x860]
push eax
lea ecx, [ebp - 0xa40]
call fcn.00427150
mov byte [ebp - 4], 0xaa
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x415dcf
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415dc5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416fca
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
xor dl, dl
mov byte [ebp - 4], 0xa9
lea ecx, [ebp - 0x860]
call fcn.00427e90
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
test al, al
jne 0x415ed1
cmp dword [0x49ad28], 0
jg 0x415e85
sub esp, 8
mov dword [ebp - 0xb60], 0
lea ecx, [ebp - 0xb58]
call fcn.004235a0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xabc], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab8], 0x128
call edi
push 0x128
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xab4], eax
call fcn.00426000
or ebx, 0x400
mov byte [ebp - 4], 0xae
mov edx, str.delete_qqprotect.sys_after_reboot_
mov dword [ebp - 0xaa4], ebx
lea ecx, [ebp - 0xb58]
call fcn.00407b40
jmp 0x415e8b
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], 0xa9
test ebx, 0x400
je 0x415eb1
and ebx, 0xfffffbff
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xaa4], ebx
call fcn.00425b00
lea ecx, [ebp - 0x860]
call fcn.00406940
cmp eax, 0x104
jae 0x415ed7
push 5
push 0
call fcn.00401810
push eax
call esi
jmp 0x415ed7
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x14
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
lea ecx, [ebp - 0x848]
push str.driversQQFrmMgr.sys
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0xaf
push eax
lea eax, [ebp - 0x8c0]
push eax
lea ecx, [ebp - 0xa40]
call fcn.00427150
mov byte [ebp - 4], 0xb2
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x415f7b
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415f71
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416fcf
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
xor dl, dl
mov byte [ebp - 4], 0xb1
lea ecx, [ebp - 0x8c0]
call fcn.00427e90
test al, al
jne 0x416067
cmp dword [0x49ad28], 0
jg 0x416023
sub esp, 8
mov dword [ebp - 0xb60], 0
lea ecx, [ebp - 0xb58]
call fcn.004235a0
mov dword [ebp - 0xabc], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab8], 0x12e
call edi
push 0x12e
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xab4], eax
call fcn.00426000
or ebx, 0x800
mov byte [ebp - 4], 0xb6
mov edx, str.delete_qqfrmmgr.sys_after_reboot_
mov dword [ebp - 0xaa4], ebx
lea ecx, [ebp - 0xb58]
call fcn.00407b40
mov dword [ebp - 4], 0xb1
test ebx, 0x800
je 0x416049
and ebx, 0xfffff7ff
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xaa4], ebx
call fcn.00425b00
lea ecx, [ebp - 0x8c0]
call fcn.00406940
cmp eax, 0x104
jae 0x416067
push 5
push 0
call fcn.00401810
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.SYSTEMCurrentControlSetServicesQQProtect
push reloc.OLEAUT32.dll_SysReAllocString
call edi
cmp dword [0x49ad28], 0
jg 0x4160ef
sub esp, 8
mov dword [ebp - 0xb60], 0
lea ecx, [ebp - 0xb58]
call fcn.004235a0
mov dword [ebp - 0xabc], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab8], 0x133
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x133
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xab4], eax
call fcn.00426000
or ebx, 0x1000
mov byte [ebp - 4], 0xb7
mov edx, str.deleted:_SYSTEMCurrentControlSetServicesQQProtect
mov dword [ebp - 0xaa4], ebx
lea ecx, [ebp - 0xb58]
call fcn.00407b40
mov dword [ebp - 4], 0xb1
test ebx, 0x1000
je 0x416115
and ebx, 0xffffefff
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xaa4], ebx
call fcn.00425b00
push str.SYSTEMCurrentControlSetServicesQQFrmMgr
push reloc.OLEAUT32.dll_SysReAllocString
call edi
cmp dword [0x49ad28], 0
jg 0x416197
sub esp, 8
mov dword [ebp - 0xb60], 0
lea ecx, [ebp - 0xb58]
call fcn.004235a0
mov dword [ebp - 0xabc], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab8], 0x136
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x136
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xab4], eax
call fcn.00426000
or ebx, 0x2000
mov byte [ebp - 4], 0xb8
mov edx, str.deleted:_SYSTEMCurrentControlSetServicesQQFrmMgr
mov dword [ebp - 0xaa4], ebx
lea ecx, [ebp - 0xb58]
call fcn.00407b40
mov dword [ebp - 4], 0xb1
test ebx, 0x2000
je 0x4161bd
and ebx, 0xffffdfff
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xaa4], ebx
call fcn.00425b00
lea ecx, [ebp - 0x8c0]
mov byte [ebp - 4], 0xa9
call fcn.00401850
lea ecx, [ebp - 0x860]
mov byte [ebp - 4], 0x9a
call fcn.00401850
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00452a30
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [ebp - 0x838], 0
lea ecx, [ebp - 0x420]
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x838], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416240
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x848]
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0xb9
push eax
lea ecx, [ebp - 0x8c0]
call fcn.00401920
mov byte [ebp - 4], 0xbc
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x4162bc
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4162b2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416fd4
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
mov byte [ebp - 4], 0xbb
lea ecx, [ebp - 0x860]
push 0x19
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], eax
push str.TencentQQQQAntiPhishing
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
call fcn.00401a50
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0xc0
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x8c0]
call fcn.00427150
lea ecx, [ebp - 0x8c0]
mov byte [ebp - 4], 0xc1
cmp ecx, eax
je 0x416356
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x416347
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x8c0]
call fcn.00401a50
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0xc0
call fcn.00401850
mov byte [ebp - 4], 0xc2
mov edx, dword [ebp - 0x84c]
cmp edx, 8
jb 0x4163a9
mov ecx, dword [ebp - 0x860]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41639f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416fd9
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
mov byte [ebp - 4], 0xbb
lea ecx, [ebp - 0x848]
push 0xc
mov dword [ebp - 0x838], eax
mov dword [ebp - 0x834], eax
push str.tsurllib.bin
mov dword [ebp - 0x838], eax
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0xc6
push eax
lea eax, [ebp - 0xa10]
push eax
lea ecx, [ebp - 0x8c0]
call fcn.00427150
mov byte [ebp - 4], 0xc9
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x416460
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x416456
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416fde
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
xor dl, dl
mov byte [ebp - 4], 0xc8
lea ecx, [ebp - 0xa10]
call fcn.00427e90
test al, al
jne 0x416550
cmp dword [0x49ad28], 0
jg 0x41650c
sub esp, 8
mov dword [ebp - 0xb60], 0
lea ecx, [ebp - 0xb58]
call fcn.004235a0
mov dword [ebp - 0xabc], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab8], 0x150
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x150
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xab4], eax
call fcn.00426000
or ebx, 0x4000
mov byte [ebp - 4], 0xcd
mov edx, str.delete_tsurllib.bin_after_reboot_
mov dword [ebp - 0xaa4], ebx
lea ecx, [ebp - 0xb58]
call fcn.00407b40
mov dword [ebp - 4], 0xc8
test ebx, 0x4000
je 0x416532
and ebx, 0xffffbfff
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xaa4], ebx
call fcn.00425b00
lea ecx, [ebp - 0xa10]
call fcn.00406940
cmp eax, 0x104
jae 0x416550
push 5
push 0
call fcn.00401810
push eax
call esi
xor eax, eax
mov dword [ebp - 0x838], 0
lea ecx, [ebp - 0x420]
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x838], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416590
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x848]
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0xce
push eax
lea ecx, [ebp - 0x878]
call fcn.00401920
mov byte [ebp - 4], 0xd1
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x41660c
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x416602
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416fe3
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
mov byte [ebp - 4], 0xd0
lea ecx, [ebp - 0x860]
push 0x1a
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], eax
push str.TencentQQQQProtectQScan
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
call fcn.00401a50
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 0xd5
push eax
lea eax, [ebp - 0xaa0]
push eax
lea ecx, [ebp - 0x878]
call fcn.00427150
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], 0xd6
cmp ecx, eax
je 0x4166a6
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x416697
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x878]
call fcn.00401a50
lea ecx, [ebp - 0xaa0]
mov byte [ebp - 4], 0xd5
call fcn.00401850
mov byte [ebp - 4], 0xd7
mov edx, dword [ebp - 0x84c]
cmp edx, 8
jb 0x4166f9
mov ecx, dword [ebp - 0x860]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4166ef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416fe8
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
mov byte [ebp - 4], 0xd0
lea ecx, [ebp - 0x848]
push 0xf
mov dword [ebp - 0x838], eax
mov dword [ebp - 0x834], eax
push str.QScanEngine.dll
mov dword [ebp - 0x838], eax
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0xdb
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x878]
call fcn.00427150
mov byte [ebp - 4], 0xde
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x4167b0
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4167a6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416fed
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
xor dl, dl
mov byte [ebp - 4], 0xdd
lea ecx, [ebp - 0x8a8]
call fcn.00427e90
cmp dword [0x49ad28], 0
mov byte [ebp - 0xaa8], al
jg 0x41686f
sub esp, 8
mov dword [ebp - 0xb60], 0
lea ecx, [ebp - 0xb58]
call fcn.004235a0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xabc], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab8], 0x186
call esi
push 0x186
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xab4], eax
call fcn.00426000
mov byte [ebp - 4], 0xe2
lea ecx, [ebp - 0xb58]
push dword [ebp - 0xaa8]
or ebx, 0x8000
mov edx, str.delete_QScanEngine.dll
mov dword [ebp - 0xaa4], ebx
call fcn.00407b40
mov ecx, eax
call fcn.00417520
jmp 0x416875
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], 0xdd
test ebx, 0x8000
je 0x41689b
and ebx, 0xffff7fff
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xaa4], ebx
call fcn.00425b00
push 0xa
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
lea ecx, [ebp - 0x848]
push str.config.dat
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0xe3
push eax
lea eax, [ebp - 0xa28]
push eax
lea ecx, [ebp - 0x878]
call fcn.00427150
mov byte [ebp - 4], 0xe6
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x41693f
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x416935
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416ff2
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
xor dl, dl
mov byte [ebp - 4], 0xe5
lea ecx, [ebp - 0xa28]
call fcn.00427e90
cmp dword [0x49ad28], 0
mov byte [ebp - 0xaa8], al
jg 0x4169f2
sub esp, 8
mov dword [ebp - 0xb60], 0
lea ecx, [ebp - 0xb58]
call fcn.004235a0
mov dword [ebp - 0xabc], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab8], 0x18a
call esi
push 0x18a
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xab4], eax
call fcn.00426000
mov byte [ebp - 4], 0xea
lea ecx, [ebp - 0xb58]
push dword [ebp - 0xaa8]
or ebx, 0x10000
mov edx, str.delete_config.dat
mov dword [ebp - 0xaa4], ebx
call fcn.00407b40
mov ecx, eax
call fcn.00417520
mov dword [ebp - 4], 0xe5
test ebx, 0x10000
je 0x416a18
and ebx, 0xfffeffff
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xaa4], ebx
call fcn.00425b00
push 7
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
lea ecx, [ebp - 0x848]
push str.sig.dat
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0xeb
push eax
lea eax, [ebp - 0xa58]
push eax
lea ecx, [ebp - 0x878]
call fcn.00427150
mov byte [ebp - 4], 0xee
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x416abc
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x416ab2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416ff7
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
xor dl, dl
mov byte [ebp - 4], 0xed
lea ecx, [ebp - 0xa58]
call fcn.00427e90
cmp dword [0x49ad28], 0
mov byte [ebp - 0xaa8], al
jg 0x416b6f
sub esp, 8
mov dword [ebp - 0xb60], 0
lea ecx, [ebp - 0xb58]
call fcn.004235a0
mov dword [ebp - 0xabc], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab8], 0x18e
call esi
push 0x18e
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xab4], eax
call fcn.00426000
mov byte [ebp - 4], 0xf2
lea ecx, [ebp - 0xb58]
push dword [ebp - 0xaa8]
or ebx, 0x20000
mov edx, str.delete_sig.dat_failed_
mov dword [ebp - 0xaa4], ebx
call fcn.00407b40
mov ecx, eax
call fcn.00417520
mov dword [ebp - 4], 0xed
test ebx, 0x20000
je 0x416b95
and ebx, 0xfffdffff
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xaa4], ebx
call fcn.00425b00
push 0xa
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
lea ecx, [ebp - 0x848]
push str.QSLSig.dat
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
call fcn.00401a50
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 0xf3
push eax
lea eax, [ebp - 0x9e0]
push eax
lea ecx, [ebp - 0x878]
call fcn.00427150
mov byte [ebp - 4], 0xf6
mov edx, dword [ebp - 0x834]
cmp edx, 8
jb 0x416c39
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x416c2f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416ffc
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
xor dl, dl
mov byte [ebp - 4], 0xf5
lea ecx, [ebp - 0x9e0]
call fcn.00427e90
cmp dword [0x49ad28], 0
mov byte [ebp - 0xaa8], al
jg 0x416cec
sub esp, 8
mov dword [ebp - 0xb60], 0
lea ecx, [ebp - 0xb58]
call fcn.004235a0
mov dword [ebp - 0xabc], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab8], 0x192
call esi
push 0x192
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xab4], eax
call fcn.00426000
mov byte [ebp - 4], 0xfa
lea ecx, [ebp - 0xb58]
push dword [ebp - 0xaa8]
or ebx, 0x40000
mov edx, str.delete_QSLSig.dat_failed_
mov dword [ebp - 0xaa4], ebx
call fcn.00407b40
mov ecx, eax
call fcn.00417520
mov dword [ebp - 4], 0xf5
test ebx, 0x40000
je 0x416d06
lea ecx, [ebp - 0xb60]
call fcn.00425b00
lea ecx, [ebp - 0x9e0]
mov byte [ebp - 4], 0xed
call fcn.00401850
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0xe5
call fcn.00401850
lea ecx, [ebp - 0xa28]
mov byte [ebp - 4], 0xdd
call fcn.00401850
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0xd0
call fcn.00401850
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], 0xc8
call fcn.00401850
lea ecx, [ebp - 0xa10]
mov byte [ebp - 4], 0xbb
call fcn.00401850
lea ecx, [ebp - 0x8c0]
mov byte [ebp - 4], 0x9a
call fcn.00401850
lea ecx, [ebp - 0xa40]
mov byte [ebp - 4], 0x95
call fcn.00401850
lea ecx, [ebp - 0xa70]
mov byte [ebp - 4], 0x86
call fcn.00401850
lea ecx, [ebp - 0xa88]
mov byte [ebp - 4], 0x75
call fcn.00401850
lea ecx, [ebp - 0x9f8]
mov byte [ebp - 4], 0x6e
call fcn.00401850
lea ecx, [ebp - 0x938]
mov byte [ebp - 4], 0x67
call fcn.00401850
lea ecx, [ebp - 0x950]
mov byte [ebp - 4], 0x60
call fcn.00401850
lea ecx, [ebp - 0x8f0]
mov byte [ebp - 4], 0x59
call fcn.00401850
lea ecx, [ebp - 0x908]
mov byte [ebp - 4], 0x52
call fcn.00401850
lea ecx, [ebp - 0x968]
mov byte [ebp - 4], 0x4b
call fcn.00401850
lea ecx, [ebp - 0x980]
mov byte [ebp - 4], 0x44
call fcn.00401850
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], 0x32
call fcn.00401850
lea ecx, [ebp - 0x998]
mov byte [ebp - 4], 0x1a
call fcn.00401850
lea ecx, [ebp - 0x9b0]
mov byte [ebp - 4], 0xb
call fcn.00401850
lea ecx, [ebp - 0x920]
mov byte [ebp - 4], 0xa
call fcn.00401850
mov byte [ebp - 4], 0xfb
mov edx, dword [ebp - 0x8c4]
cmp edx, 8
jb 0x416e85
mov ecx, dword [ebp - 0x8d8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x416e7b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417001
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x8c8], 0
mov dword [ebp - 0x8c4], 7
mov word [ebp - 0x8d8], ax
lea ecx, [ebp - 0x9c8]
mov dword [ebp - 4], 0xffffffff
call fcn.00401850
jmp 0x416f4a
cmp dword [0x49ad28], 0
jg 0x416f33
sub esp, 8
mov dword [ebp - 0xb60], 0
lea ecx, [ebp - 0xb58]
call fcn.004235a0
mov dword [ebp - 0xabc], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
mov dword [ebp - 0xab8], 0x9d
call edi
push 0x9d
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetupuninstalluninstall_delete_qp_files.cpp
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0xab4], eax
call fcn.00426000
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xb58]
or ebx, 2
mov edx, str.doDeleteQPFiles_returned__no_delete__theres_still_other_product:
push esi
mov dword [ebp - 0xaa4], ebx
call fcn.00407b40
mov ecx, eax
call fcn.00405ad0
mov dword [ebp - 4], 0xffffffff
test bl, 2
je 0x416f4a
lea ecx, [ebp - 0xb60]
call fcn.00425b00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00450164
mov esp, ebp
pop ebp
ret
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
int3