Function at 0x44e740
Capabilities:
Check if file exists
Copy file
Delete registry value
Get installed programs
Persist via run registry key
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d52e8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str..qbox
push SysReAllocString
mov dword [ebp - 0x2c], 0
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov eax, dword [ebp - 0x2c]
jne 0x44e7c8
test eax, eax
je 0x44e7ca
push 0x1a
push str.QQPCMgr.qbox
push 1
push 0
push 0x4ec230
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x44e7d5
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.QQPCMgr.qbox
push SysReAllocString
call esi
test eax, eax
mov eax, dword [ebp - 0x2c]
jne 0x44e81c
test eax, eax
je 0x44e823
push 0x1e
push 0x4f200c
push 1
push 0
push 0x4ec230
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44e823
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.QQPCMgr.qboxDefaultIcon
push SysReAllocString
call esi
test eax, eax
jne 0x44e8ba
mov edx, dword [ebp - 0x3c]
lea ecx, [ebp - 0x30]
push str.imageqbox.ico_0
lea edx, [edx + 4]
call fcn.0041c030
add esp, 4
mov esi, dword [eax]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44e899
mov edx, esi
lea ecx, [edx + 2]
mov dword [ebp - 0x34], ecx
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x44e874
sub edx, dword [ebp - 0x34]
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push esi
push 1
push 0
push 0x4ec230
push eax
call ebx
mov edx, dword [ebp - 0x30]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44e8b4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44e8c4
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.QQPCMgr.qbox_shell
push SysReAllocString
call esi
test eax, eax
mov eax, dword [ebp - 0x2c]
jne 0x44e90b
test eax, eax
je 0x44e912
push 2
push 0x4ec230
push 1
push 0
push 0x4ec230
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44e912
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.QQPCMgr.qbox_shellopen
push SysReAllocString
call esi
test eax, eax
mov eax, dword [ebp - 0x2c]
jne 0x44e959
test eax, eax
je 0x44e960
push 0x10
push 0x4f20dc
push 1
push 0
push 0x4ec230
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44e960
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.QQPCMgr.qbox_shellcommand
push SysReAllocString
call esi
test eax, eax
jne 0x44e9f7
mov edx, dword [ebp - 0x3c]
lea ecx, [ebp - 0x34]
push str.QQPCFileSafe.exe___1_
lea edx, [edx + 4]
call fcn.0041c030
add esp, 4
mov esi, dword [eax]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44e9d6
mov edx, esi
lea ecx, [edx + 2]
mov dword [ebp - 0x30], ecx
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x44e9b1
sub edx, dword [ebp - 0x30]
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push esi
push 1
push 0
push 0x4ec230
push eax
call ebx
mov edx, dword [ebp - 0x34]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44e9f1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44ea01
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x44ebee
push 0x4edd30
lea ecx, [ebp - 0x34]
call fcn.0041c9e0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + 4]
test edx, edx
jne 0x44ea4e
xor ecx, ecx
jmp 0x44ea62
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44ea53
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x34]
call fcn.0041c4b0
push 0xd
push str.QQPCTray.exe_
lea ecx, [ebp - 0x34]
call fcn.0041c4b0
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44eacf
mov ecx, dword [ebp - 0x34]
mov esi, ecx
lea edx, [esi + 2]
mov dword [ebp - 0x30], edx
nop dword [eax]
mov dx, word [esi]
add esi, 2
test dx, dx
jne 0x44ea90
sub esi, dword [ebp - 0x30]
sar esi, 1
lea edx, [esi*2 + 2]
push edx
push ecx
push 1
push 0
push str.DisplayIcon
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44eacf
push 0xa
push 0x4f21fc
push 1
push 0
push 0x4ef380
push eax
call ebx
push 1
push 0x4edd30
lea ecx, [ebp - 0x34]
call fcn.0041cd40
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + 4]
test edx, edx
jne 0x44eaec
xor ecx, ecx
jmp 0x44eb00
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44eaf1
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x34]
call fcn.0041c4b0
push 0xb
push str.Uninst.exe_
lea ecx, [ebp - 0x34]
call fcn.0041c4b0
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44eb58
mov ecx, dword [ebp - 0x34]
mov esi, ecx
lea edx, [esi + 2]
mov dword [ebp - 0x30], edx
nop dword [eax + eax]
mov dx, word [esi]
add esi, 2
test dx, dx
jne 0x44eb30
sub esi, dword [ebp - 0x30]
sar esi, 1
lea edx, [esi*2 + 2]
push edx
push ecx
push 1
push 0
push str.UninstallString
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x3c]
mov esi, dword [ecx + 0xc]
test eax, eax
je 0x44ebc9
mov edx, esi
lea ecx, [edx + 2]
mov dword [ebp - 0x30], ecx
nop word [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x44eb70
sub edx, dword [ebp - 0x30]
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push esi
push 1
push 0
push 0x4f2240
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44ebc9
push 0x4e
push str.http:__pc.qq.com_pc_softmgr_index.html
push 1
push 0
push str.URLInfoAbout
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44ebc9
push 0x1a
push 0x4f22cc
push 1
push 0
push str.Publisher
push eax
call ebx
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44ebe8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44ebf8
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSet_servicesQQPCRTP
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
mov eax, dword [ebp - 0x2c]
jne 0x44ec45
mov dword [ebp - 0x30], 0
test eax, eax
je 0x44ec4c
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.RtpFlag
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44ec4c
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARETencent
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
mov eax, dword [ebp - 0x2c]
jne 0x44ec93
test eax, eax
je 0x44ec9a
push 4
push 0x4ed1c8
push 1
push 0
push str.QQPCFlag
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44ec9a
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x44f187
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov edx, dword [eax + 4]
xor eax, eax
mov word [ebp - 0x28], ax
cmp word [edx], ax
jne 0x44eceb
xor ecx, ecx
jmp 0x44ecff
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44ecf0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.004393e0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004886a0
cmp dword [ebp - 0x14], 8
lea edi, [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
cmovae edi, dword [ebp - 0x28]
xor esi, esi
test eax, eax
je 0x44ed60
mov edx, edi
lea ecx, [edx + 2]
mov dword [ebp - 0x30], ecx
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x44ed31
sub edx, dword [ebp - 0x30]
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push edi
push 1
push 0
push str.InstallDir
push eax
call ebx
test eax, eax
mov eax, 1
cmove esi, eax
push esi
push str.WriteReg_InstallDir__Result_:__d
push 0x515408
call fcn.0048be90
mov ecx, dword [ebp - 0x3c]
add esp, 0xc
cmp dword [ecx + 0x1c], 0
je 0x44ed87
test esi, esi
je 0x44ed87
mov eax, 1
jmp 0x44ed89
xor eax, eax
mov edi, dword [ecx + 0xc]
xor esi, esi
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44edcf
mov edx, edi
lea ecx, [edx + 2]
mov dword [ebp - 0x30], ecx
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x44eda0
sub edx, dword [ebp - 0x30]
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push edi
push 1
push 0
push str.Version
push eax
call ebx
test eax, eax
mov eax, 1
cmove esi, eax
push esi
push str.WriteReg_Version__Result_:__d
push 0x515408
call fcn.0048be90
mov ecx, dword [ebp - 0x3c]
add esp, 0xc
cmp dword [ecx + 0x1c], 0
je 0x44edf6
test esi, esi
je 0x44edf6
mov eax, 1
jmp 0x44edf8
xor eax, eax
mov dword [ecx + 0x1c], eax
lea edx, [ecx + 4]
push str.QQPCMgr.exe
lea ecx, [ebp - 0x30]
call fcn.0041c030
add esp, 4
mov esi, dword [eax]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44ee44
mov edx, esi
lea edi, [edx + 2]
nop dword [eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x44ee20
sub edx, edi
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push esi
push 1
push 0
push str.ExeString
push eax
call ebx
mov edx, dword [ebp - 0x30]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44ee5f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 1
test eax, eax
je 0x44ee82
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.IdleScanTip
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
test eax, eax
je 0x44eea2
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.FirstRun
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 1
test eax, eax
je 0x44eec2
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.IsTrayCrashed
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x44eee0
lea eax, [ecx + 1]
push eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00433850
mov eax, dword [ebp - 0x2c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x44eef3
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARETencentQQPCMgrVulFW
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
mov eax, dword [ebp - 0x2c]
jne 0x44ef40
mov dword [ebp - 0x30], 1
test eax, eax
je 0x44ef47
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.bCameraProtection
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44ef47
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
mov eax, dword [ebp - 0x2c]
jne 0x44ef9a
test eax, eax
je 0x44efa1
push str.QMTray
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44efa1
push 0x4f24b0
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44efa1
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunQQDisabled
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x44eff1
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44eff1
push 0x4f24b0
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44eff1
push str._QQPCTray
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0x3c]
call fcn.0044e340
mov eax, dword [0x511ea4]
cmp eax, 0xffffffff
jne 0x44f045
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x44f18f
push 0x511ea4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x44f18f
mov eax, dword [0x511ea4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x44f0c5
push str.Set_TSKSP_autostart
push 0x515408
call fcn.0048be90
mov eax, dword [ebp - 0x2c]
add esp, 8
test eax, eax
je 0x44f069
push eax
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2c]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTSKSP
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2c], 0
call esi
test eax, eax
jne 0x44f0b3
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44f0b3
push 4
push 0x4ed1c8
push 1
push 0
push str.autostart
push eax
call ebx
push str.Set_TSKSP_autostart_end
push 0x515408
call fcn.0048be90
add esp, 8
push str.Set_QQSoftMgr_reg
push 0x515408
call fcn.0048be90
mov eax, dword [ebp - 0x2c]
add esp, 8
test eax, eax
je 0x44f0e1
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARETENCENTDeskUpdateQQSoftMgr
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x44f246
mov edx, dword [ebp - 0x3c]
lea ecx, [ebp - 0x30]
add edx, 4
push str.QQPCSoftMgr.exe
call fcn.0041c030
add esp, 4
mov esi, dword [eax]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44f157
mov edx, esi
lea edi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x44f133
sub edx, edi
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push esi
push 1
push 0
push str.ExeString
push eax
call ebx
mov edx, dword [ebp - 0x30]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f172
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.0041bef0
mov ecx, eax
test ecx, ecx
jne 0x44f19e
push 0x80004005
call fcn.0041ce60
mov eax, dword [ebp - 0x2c]
jmp 0x44eeec
mov dword [0x511ea4], 0
jmp 0x44f04d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 3
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.0043fa60
mov esi, dword [ebp - 0x34]
test eax, eax
je 0x44f22a
mov eax, dword [esi - 0xc]
test eax, eax
je 0x44f22a
push ecx
mov edi, esp
mov dword [ebp - 0x38], edi
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 4]
sub ecx, 0x10
call fcn.0041c6e0
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x30]
push eax
call fcn.00451860
lea ecx, [ebp - 0x2c]
push dword [eax]
push str.InstallDir
call fcn.0043fb50
mov edx, dword [ebp - 0x30]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f218
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.0.500
push str.Version
lea ecx, [ebp - 0x2c]
call fcn.0043fb50
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44f246
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push str.Set_TsFltMgr_reg
push 0x515408
call fcn.0048be90
add esp, 8
cmp dword [0x511ea4], 0xffffffff
jne 0x44f29c
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x44f290
push 0x511ea4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
jne 0x44f29c
mov dword [0x511ea4], 0
jmp 0x44f2a9
cmp dword [0x511ea4], 0
jne 0x44fb86
mov eax, dword [ebp - 0x2c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x44f2b9
push eax
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2c]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTsFltMgr
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2c], 0
call esi
test eax, eax
jne 0x44f4f5
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44f300
push str.DeleteFlag
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x28]
call fcn.00489730
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.0048d580
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
cmovae esi, dword [ebp - 0x28]
test eax, eax
je 0x44f355
mov edx, esi
lea ecx, [edx + 2]
mov dword [ebp - 0x30], ecx
nop
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x44f330
sub edx, dword [ebp - 0x30]
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push esi
push 1
push 0
push str.InstallDir
push eax
call ebx
push str.TsFltMgr.sys
lea ecx, [ebp - 0x34]
call fcn.0041c9e0
mov byte [ebp - 4], 5
call fcn.00488650
test eax, eax
je 0x44f37c
push str.TsFltMgr_ev.sys
lea ecx, [ebp - 0x34]
call fcn.0041cdf0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x28]
call fcn.0048d880
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x30]
lea edx, [edx + 4]
call fcn.00422020
add esp, 4
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae ecx, dword [ebp - 0x28]
push 0
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edx, dword [ebp - 0x30]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f3cf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44f49a
lea eax, [ebp - 0x34]
mov edx, str.System32drivers_
push eax
lea ecx, [ebp - 0x30]
call fcn.00438690
add esp, 4
lea ecx, [ebp - 0x2c]
push dword [eax]
push str.ImagePath
call fcn.0043fb50
mov edx, dword [ebp - 0x30]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f426
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
test eax, eax
je 0x44f449
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.ErrorControl
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
test eax, eax
je 0x44f469
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.Start
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 1
test eax, eax
je 0x44f486
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.Type
push eax
call ebx
push str.TsFltMgr
push 0x4ef380
lea ecx, [ebp - 0x2c]
call fcn.0043fb50
jmp 0x44f4b8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.Not_Found__ws
push 0x515408
call fcn.0048be90
add esp, 0xc
mov byte [ebp - 4], 4
mov eax, esi
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f4d6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x44f4ef
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00433850
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push str.WriteRegStr_TSKSP_..begin
push 0x515408
call fcn.0048be90
mov eax, dword [ebp - 0x2c]
add esp, 8
test eax, eax
je 0x44f511
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTSKSP
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x44f74d
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44f552
push str.DeleteFlag
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x28]
push dword [eax + 4]
call fcn.004388e0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.0048d580
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
cmovae esi, dword [ebp - 0x28]
test eax, eax
je 0x44f5ab
mov edx, esi
lea ecx, [edx + 2]
mov dword [ebp - 0x30], ecx
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x44f586
sub edx, dword [ebp - 0x30]
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push esi
push 1
push 0
push str.InstallDir
push eax
call ebx
push str.TSKsp.sys
lea ecx, [ebp - 0x34]
call fcn.0041c9e0
mov byte [ebp - 4], 7
call fcn.00488650
test eax, eax
je 0x44f5d2
push str.TSKsp_ev.sys
lea ecx, [ebp - 0x34]
call fcn.0041cdf0
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x30]
lea edx, [edx + 4]
call fcn.00422020
add esp, 4
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x30]
mov esi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x44f60c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x44f70d
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x38]
add eax, 4
mov edx, 0x4ef314
push eax
call fcn.00438690
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 8
push ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00422020
add esp, 8
lea ecx, [ebp - 0x2c]
push dword [eax]
push str.ImagePath
call fcn.0043fb50
mov edx, dword [ebp - 0x30]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f669
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov eax, esi
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f687
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], 0
test eax, eax
je 0x44f6aa
push 4
lea ecx, [ebp - 0x38]
push ecx
push 4
push 0
push str.ErrorControl
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], 1
test eax, eax
je 0x44f6ca
push 4
lea ecx, [ebp - 0x38]
push ecx
push 4
push 0
push str.Start
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], 1
test eax, eax
je 0x44f6e7
push 4
lea ecx, [ebp - 0x38]
push ecx
push 4
push 0
push str.Type
push eax
call ebx
push str.TSKSP
push 0x4ef380
lea ecx, [ebp - 0x2c]
call fcn.0043fb50
push 0x4ed1c8
push str.autostart
lea ecx, [ebp - 0x2c]
call fcn.0043fb50
jmp 0x44f710
or esi, 0xffffffff
mov byte [ebp - 4], 6
mov eax, esi
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f72e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x44f747
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00433850
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push str.WriteRegStr_TSKSP_..end
push 0x515408
call fcn.0048be90
mov eax, dword [ebp - 0x2c]
add esp, 8
test eax, eax
je 0x44f769
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTSSysKit
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x44f97d
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44f7aa
push str.DeleteFlag
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x28]
push dword [eax + 4]
call fcn.004388e0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.0048d580
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
cmovae esi, dword [ebp - 0x28]
test eax, eax
je 0x44f805
mov edx, esi
lea ecx, [edx + 2]
mov dword [ebp - 0x38], ecx
nop
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x44f7e0
sub edx, dword [ebp - 0x38]
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push esi
push 1
push 0
push str.InstallDir
push eax
call ebx
push 0x4efa10
lea ecx, [ebp - 0x34]
call fcn.0041c9e0
mov byte [ebp - 4], 0xa
call fcn.00488650
test eax, eax
je 0x44f82c
push str.TSSysKit_ev.sys
lea ecx, [ebp - 0x34]
call fcn.0041cdf0
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x38]
lea edx, [edx + 4]
call fcn.00422020
add esp, 4
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x38]
mov esi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x44f866
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x44f943
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x30]
add eax, 4
mov edx, 0x4ef314
push eax
call fcn.00438690
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xb
push ecx
mov edx, eax
lea ecx, [ebp - 0x38]
call fcn.00422020
add esp, 8
lea ecx, [ebp - 0x2c]
push dword [eax]
push str.ImagePath
call fcn.0043fb50
mov edx, dword [ebp - 0x38]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f8c3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xa
mov eax, esi
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f8e1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], 0
test eax, eax
je 0x44f904
push 4
lea ecx, [ebp - 0x38]
push ecx
push 4
push 0
push str.ErrorControl
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], 1
test eax, eax
je 0x44f924
push 4
lea ecx, [ebp - 0x38]
push ecx
push 4
push 0
push str.Start
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], 1
test eax, eax
je 0x44f946
push 4
lea ecx, [ebp - 0x38]
push ecx
push 4
push 0
push str.Type
push eax
call ebx
jmp 0x44f946
or esi, 0xffffffff
mov byte [ebp - 4], 9
mov eax, esi
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f964
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x44f97d
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00433850
mov edx, dword [ebp - 0x3c]
lea ecx, [ebp - 0x38]
add edx, 4
push str.QMIEProtect.sys
call fcn.0041c030
add esp, 4
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x38]
mov esi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x44f9b8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x44fb8c
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44f9ca
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesQMIEProtect
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x44fb8c
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44fa0f
push str.DeleteFlag
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, dword [ebp - 0x3c]
lea ecx, [ebp - 0x28]
add esi, 4
push dword [esi]
call fcn.004388e0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xc
call fcn.0048d580
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x28]
push eax
push str.InstallDir
call fcn.0043fb50
push str.QMIEProtect.sys
lea ecx, [ebp - 0x34]
call fcn.0041c9e0
mov byte [ebp - 4], 0xd
call fcn.00488650
test eax, eax
je 0x44fa6b
push str.QMIEProtect_ev.sys
lea ecx, [ebp - 0x34]
call fcn.0041cdf0
push esi
mov edx, 0x4ef314
lea ecx, [ebp - 0x30]
call fcn.00438690
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xe
push ecx
mov edx, eax
lea ecx, [ebp - 0x38]
call fcn.00422020
add esp, 8
lea ecx, [ebp - 0x2c]
push dword [eax]
push str.ImagePath
call fcn.0043fb50
mov edx, dword [ebp - 0x38]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44faba
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xd
mov eax, esi
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44fad8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], 0
test eax, eax
je 0x44fafb
push 4
lea ecx, [ebp - 0x38]
push ecx
push 4
push 0
push str.ErrorControl
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], 2
test eax, eax
je 0x44fb1b
push 4
lea ecx, [ebp - 0x38]
push ecx
push 4
push 0
push str.Start
push eax
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], 1
test eax, eax
je 0x44fb38
push 4
lea ecx, [ebp - 0x38]
push ecx
push 4
push 0
push str.Type
push eax
call ebx
push str.QMIEProtect
push 0x4ef380
lea ecx, [ebp - 0x2c]
call fcn.0043fb50
push 0x4ed1c8
push str.autostart
lea ecx, [ebp - 0x2c]
call fcn.0043fb50
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x44fb78
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00433800
jmp 0x44fb8c
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x511ea4], 0xffffffff
jne 0x44fbd3
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x44fbc4
push 0x511ea4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
jne 0x44fbd3
mov dword [0x511ea4], 0
jmp 0x44fca3
cmp dword [0x511ea4], 0
je 0x44fca3
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44fbea
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesQQSysMonX64
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x44fca3
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44fc2f
push str.DeleteFlag
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x28]
push dword [eax + 4]
call fcn.004388e0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xf
call fcn.0048d580
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp eax, 8
cmovae edx, ecx
cmp dword [ebp - 0x2c], 0
je 0x44fc8f
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44fc63
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.InstallDir
push dword [ebp - 0x2c]
call ebx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x44fca3
inc eax
push eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.00433850
cmp dword [0x5153a8], 0
jne 0x44fd8e
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0x10
push eax
push 0x20019
push 0
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44fd84
lea eax, [ebp - 0x3c]
push eax
push 0x4f27c4
lea ecx, [ebp - 0x34]
call fcn.00433b10
mov eax, dword [ebp - 0x3c]
cmp eax, 0x7270e00
jb 0x44fd07
cmp eax, 0x7bfa47f
jbe 0x44fd13
add eax, 0xfffe2b3f
cmp eax, 0x270e
ja 0x44fd84
call fcn.00488a60
test eax, eax
mov eax, dword [ebp - 0x2c]
jne 0x44fd40
test eax, eax
je 0x44fd26
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesQQSysMon
jmp 0x44fd5f
test eax, eax
je 0x44fd47
push eax
call edi
push 0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesQQSysMonX64
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x44fd84
push 3
push str.spvalue
lea ecx, [ebp - 0x2c]
call fcn.0043fb20
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x44fd8e
push eax
call edi
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44fd98
push eax
call edi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a474b
mov esp, ebp
pop ebp
ret