Function at 0x54992a
Capabilities:
Check if file exists
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
push ebx
push esi
push edi
mov ebx, 0x410
lea eax, [ebp - 0x468]
push ebx
xor edi, edi
push edi
push eax
call fcn.005713c0
add esp, 0xc
mov dword [ebp - 0x28], ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x468]
push eax
push edi
push str.flash_ver_url
push str.SoftwareTencentQQBrowserPrivateCfg
push SysReAllocString
call ebx
test eax, eax
jne 0x549cea
lea eax, [ebp - 0x468]
push 0x7c
push eax
call fcn.00571cb0
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x549cea
xor eax, eax
lea ecx, [ebp - 0x40]
mov word [esi], ax
lea eax, [ebp - 0x468]
push eax
call fcn.00408981
lea edi, [esi + 2]
push 0x7c
push edi
call fcn.00571cb0
pop ecx
pop ecx
test eax, eax
je 0x549cb8
lea esi, [eax + 2]
xor ecx, ecx
cmp word [esi], cx
je 0x549cb8
lea ecx, [ebp - 1]
push ecx
push eax
push edi
lea ecx, [ebp - 0x58]
call fcn.004d8af0
cmp dword [ebp - 0x30], 0
je 0x549c88
cmp dword [ebp - 0x48], 0
je 0x549c88
xor eax, eax
mov dword [ebp - 0x28], 0x410
mov word [ebp - 0x468], ax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x468]
push eax
xor eax, eax
push eax
push str.CC_FLASH
push str.SoftwareTencentQQBrowserPrivateCfg
push SysReAllocString
call ebx
xor ebx, ebx
mov edi, str.User_DataFlash_
test eax, eax
jne 0x549b8e
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 1]
lea eax, [ebp - 0x40]
mov byte [ebp - 1], bl
cmovae eax, dword [ebp - 0x40]
push ecx
push eax
lea eax, [ebp - 0x468]
push eax
call fcn.005492d9
add esp, 0xc
cmp word [ebp - 0x468], bx
je 0x549b8e
cmp byte [ebp - 1], bl
jne 0x549b8e
test eax, eax
js 0x549b8e
push dword [ebp + 0xc]
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00407eca
push edi
call fcn.0057bbea
pop ecx
push eax
push edi
lea ecx, [ebp - 0x24]
call fcn.004092f8
lea eax, [ebp - 0x468]
push eax
call fcn.0057bbea
pop ecx
push eax
lea eax, [ebp - 0x468]
push eax
lea ecx, [ebp - 0x24]
call fcn.004092f8
mov edi, str.pepflashplayer.dll
push edi
call fcn.0057bbea
pop ecx
push eax
push edi
lea ecx, [ebp - 0x24]
call fcn.004092f8
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x549b4c
push str.flash_ver_url
push str.SoftwareTencentQQBrowserPrivateCfg
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
push 7
pop edi
mov dword [esi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], edi
cmp eax, 8
jb 0x549b3b
mov ecx, dword [ebp - 0x24]
lea eax, [eax*2 + 2]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
cmp eax, 0x1000
jb 0x549b32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040379f
mov eax, dword [ebp - 8]
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
push eax
push ecx
call fcn.0056d0c8
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], edi
mov word [ebp - 0x24], ax
jmp 0x549cae
mov eax, dword [ebp - 0x10]
cmp eax, 8
jb 0x549b89
mov ecx, dword [ebp - 0x24]
lea eax, [eax*2 + 2]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
cmp eax, 0x1000
jb 0x549b80
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0040379f
mov eax, dword [ebp - 0xc]
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
push eax
push ecx
call fcn.0056d0c8
pop ecx
pop ecx
mov edi, str.User_DataFlash_
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x549b9e
lea eax, [ebp - 0x40]
push eax
call fcn.00405d53
cmp dword [ebp + 0x14], 0
je 0x549c59
push dword [ebp + 0xc]
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00407eca
push edi
call fcn.0057bbea
pop ecx
push eax
push edi
lea ecx, [ebp - 0x24]
call fcn.004092f8
mov edi, str.install_flash_player_
push edi
call fcn.0057bbea
pop ecx
push eax
push edi
lea ecx, [ebp - 0x24]
call fcn.004092f8
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x24]
push eax
call fcn.004092f8
mov edi, 0x614920
push edi
call fcn.0057bbea
pop ecx
push eax
push edi
lea ecx, [ebp - 0x24]
call fcn.004092f8
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x24]
push eax
call fcn.0044c6a5
mov eax, dword [ebp - 0x10]
cmp eax, 8
jb 0x549c59
mov ecx, dword [ebp - 0x24]
lea eax, [eax*2 + 2]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
cmp eax, 0x1000
jb 0x549c50
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0040379f
mov eax, dword [ebp - 0xc]
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
push eax
push ecx
call fcn.0056d0c8
pop ecx
pop ecx
cmp dword [ebp + 0x18], 0
je 0x549c70
push esi
call fcn.0057bbea
pop ecx
mov ecx, dword [ebp + 0x18]
push eax
push esi
call fcn.00407684
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x58]
push eax
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.00444b1d
jmp 0x549cae
push str.flash_ver_url
push str.SoftwareTencentQQBrowserPrivateCfg
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
lea ecx, [ebp - 0x58]
call fcn.00403730
jmp 0x549cde
push str.flash_ver_url
push str.SoftwareTencentQQBrowserPrivateCfg
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
lea ecx, [ebp - 0x40]
call fcn.00403730
mov eax, esi
jmp 0x549d0e
push str.flash_ver_url
push str.SoftwareTencentQQBrowserPrivateCfg
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], 7
pop edi
pop esi
pop ebx
leave
ret