Function at 0x4c0ed0
Capabilities:
Check if file exists
Copy file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x514735
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x550144]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004c27e0
lea ecx, [ebp - 0x2c]
call fcn.00479be0
push 0
push 0
push str..qbox
push SysReAllocString
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00479c10
test eax, eax
je 0x4c0f3d
push str.QQPCMgr.qbox
push 0x53656c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0
push 0
push str.QQPCMgr.qbox
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c0f69
push 0x51df70
push 0x53656c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0
push 0
push str.QQPCMgr.qboxDefaultIcon
push SysReAllocString
lea ecx, [ebp - 0x2c]
lea edi, [esi + 4]
call fcn.00479c10
test eax, eax
je 0x4c0fb5
push str.imageqbox.ico_0
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0048c050
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
push 0x53656c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
push 0
push 0
push str.QQPCMgr.qbox_shell
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c0fe1
push 0x53656c
push 0x53656c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0
push 0
push str.QQPCMgr.qbox_shellopen
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c100d
push 0x51e040
push 0x53656c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0
push 0
push str.QQPCMgr.qbox_shellcommand
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c1056
push str.QQPCFileSafe.exe___1_
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0048c050
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
push 0x53656c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
push 0
push 0
push str.QMRemote
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c10d0
push 0x5378c0
push 0x53656c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push edi
lea eax, [ebp - 0x38]
push 0x538570
push eax
call fcn.0048cb00
push str.QMRemote.exe_
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 1
push eax
call fcn.0048c050
add esp, 0x18
mov ecx, eax
call fcn.0044c0a0
push eax
push str.URL_Protocol
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.0044c080
push 0
push 0
push str.QMRemoteShell
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c10fc
push 0x53656c
push 0x53656c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0
push 0
push str.QMRemoteShellOpen
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c1128
push 0x53656c
push 0x53656c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0
push 0
push str.QMRemoteShellOpenCommand
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c1190
push edi
lea eax, [ebp - 0x38]
push 0x538570
push eax
call fcn.0048cb00
push str.QQPCMgr.exe___pullRemote___1_
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.0048c050
add esp, 0x18
mov ecx, eax
call fcn.0044c0a0
push eax
push 0x53656c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.0044c080
push 0
push 0
push str.QMSoft
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c120a
push 0x5378c0
push 0x53656c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push edi
lea eax, [ebp - 0x38]
push 0x538570
push eax
call fcn.0048cb00
push str.QQPCSoftMgr.exe_
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 3
push eax
call fcn.0048c050
add esp, 0x18
mov ecx, eax
call fcn.0044c0a0
push eax
push str.URL_Protocol
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.0044c080
push 0
push 0
push str.QMSoftShell
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c1236
push 0x53656c
push 0x53656c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0
push 0
push str.QMSoftShellOpen
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c1262
push 0x53656c
push 0x53656c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0
push 0
push str.QMSoftShellOpenCommand
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c12ca
push edi
lea eax, [ebp - 0x38]
push 0x538570
push eax
call fcn.0048cb00
push str.QQPCMgr.exe___pullSoft___1_
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 4
push eax
call fcn.0048c050
add esp, 0x18
mov ecx, eax
call fcn.0044c0a0
push eax
push 0x53656c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.0044c080
cmp dword [esi + 0x14], 0
jne 0x4c1580
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c13ce
push 0x538570
lea ecx, [ebp - 0x34]
call fcn.0044f140
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x34]
call fcn.0048c580
push str.QQPCTray.exe_
lea ecx, [ebp - 0x34]
call fcn.0048c580
lea ecx, [ebp - 0x34]
call fcn.0044c0a0
push eax
push str.DisplayIcon
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0x5378c0
push 0x51ba3c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0x538570
lea ecx, [ebp - 0x34]
call fcn.0044f4c0
mov ecx, edi
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x34]
call fcn.0048c580
push str.Uninst.exe_
lea ecx, [ebp - 0x34]
call fcn.0048c580
lea ecx, [ebp - 0x34]
call fcn.0044c0a0
push eax
push str.UninstallString
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [esi + 0xc]
call fcn.0044c0a0
push eax
push 0x51e384
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push str.https:__guanjia.qq.com_
push str.URLInfoAbout
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0x51e3f0
push str.Publisher
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.0044c080
cmp dword [esi + 0x14], 0
jne 0x4c1580
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.004c3180
test eax, eax
je 0x4c1580
push edi
lea ecx, [ebp - 0x30]
call fcn.0048d090
push str.QQPCTray.exe
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 6
call fcn.0048c580
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x30]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push edi
lea ecx, [ebp - 0x38]
call fcn.0048d090
push str.QQPCExternal.exe
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 7
call fcn.0048c580
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x38]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push edi
lea ecx, [ebp - 0x3c]
call fcn.0048d090
push str.QQPCSoftMgr.exe
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 8
call fcn.0048c580
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x3c]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push edi
lea ecx, [ebp - 0x48]
call fcn.0048d090
push str.QMSecurityLab.exe
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 9
call fcn.0048c580
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x48]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push edi
lea ecx, [ebp - 0x44]
call fcn.0048d090
push str.QMLspPing.exe
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xa
call fcn.0048c580
push str._PERPROCESSSYSTEMDPIFORCEON_HIGHDPIAWARE
lea ecx, [ebp - 0x44]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push edi
lea ecx, [ebp - 0x40]
call fcn.0048d090
push str.NetworkMon.exe
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xb
call fcn.0048c580
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x40]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push edi
lea ecx, [ebp - 0x34]
call fcn.0048d090
push str.QMFileSearchApp.exe
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xc
call fcn.0048c580
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x34]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x34]
call fcn.0044c080
lea ecx, [ebp - 0x40]
call fcn.0044c080
lea ecx, [ebp - 0x44]
call fcn.0044c080
lea ecx, [ebp - 0x48]
call fcn.0044c080
lea ecx, [ebp - 0x3c]
call fcn.0044c080
lea ecx, [ebp - 0x38]
call fcn.0044c080
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.0044c080
push 0
push 0
push str.SYSTEMCurrentControlSet_servicesQQPCRTP
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c15a9
push 0
push str.RtpFlag
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 0
push 0
push str.SOFTWARETencent
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c15d5
push 0x519090
push str.QQPCFlag
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0
push 0
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c16fd
mov ecx, edi
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x28]
call fcn.0048cfc0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xd
push eax
call fcn.00487420
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.0044a630
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
mov ebx, eax
push ebx
push str.WriteReg_InstallDir__Result_:__d
push 0x550bb8
call fcn.0048d540
add esp, 0xc
cmp dword [esi + 0x20], 0
je 0x4c164f
test ebx, ebx
je 0x4c164f
mov eax, 1
jmp 0x4c1651
xor eax, eax
lea ecx, [esi + 0xc]
mov dword [esi + 0x20], eax
call fcn.0044c0a0
push eax
push str.Version
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
mov ebx, eax
push ebx
push str.WriteReg_Version__Result_:__d
push 0x550bb8
call fcn.0048d540
add esp, 0xc
cmp dword [esi + 0x20], 0
je 0x4c1690
test ebx, ebx
je 0x4c1690
mov eax, 1
jmp 0x4c1692
xor eax, eax
push str.QQPCMgr.exe
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0048c050
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
push str.ExeString
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
push 1
push str.IdleScanTip
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 0
push str.FirstRun
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 1
push str.IsTrayCrashed
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a640
push 0
push 0
push str.SOFTWARETencentQQPCMgrVulFW
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c1726
push 1
push str.bCameraProtection
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c175a
push str.QMTray
lea ecx, [ebp - 0x2c]
call fcn.00492d40
push 0x51e70c
lea ecx, [ebp - 0x2c]
call fcn.00492d40
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunQQDisabled
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c178e
push 0x51e70c
lea ecx, [ebp - 0x2c]
call fcn.00492d40
push str._QQPCTray
lea ecx, [ebp - 0x2c]
call fcn.00492d40
push 0
push 0
push str.QMConfigQQDoctorQQDoctorComCfg
push reloc.WS2_32.dll_closesocket
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c17b5
push str.defCoveredRemoteSetting
lea ecx, [ebp - 0x2c]
call fcn.00492d40
mov ecx, esi
call fcn.004c2040
call fcn.004878d0
test eax, eax
jne 0x4c1815
push str.Set_TSKSP_autostart
push 0x550bb8
call fcn.0048d540
add esp, 8
lea ecx, [ebp - 0x2c]
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTSKSP
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00479c10
test eax, eax
je 0x4c1803
push 0x519090
push str.autostart
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push str.Set_TSKSP_autostart_end
push 0x550bb8
call fcn.0048d540
add esp, 8
push str.Set_QQSoftMgr_reg
push 0x550bb8
call fcn.0048d540
add esp, 8
lea ecx, [ebp - 0x2c]
push 0
push 0
push str.SOFTWARETENCENTDeskUpdateQQSoftMgr
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00479c10
lea edi, [esi + 4]
test eax, eax
je 0x4c18ff
push str.QQPCSoftMgr.exe
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0048c050
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
push str.ExeString
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x34]
call fcn.0047d1f0
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0xe
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00479d70
test eax, eax
je 0x4c18f3
lea ecx, [ebp - 0x34]
call fcn.0048d370
test al, al
jne 0x4c18f3
lea ecx, [ebp - 0x34]
call fcn.0044f760
test eax, eax
je 0x4c18f3
push ecx
mov ecx, esp
push edi
call fcn.0048d090
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.004c2590
mov ecx, eax
call fcn.0044c0a0
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
push str.0.500
push str.Version
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.0044c080
push str.Set_TsFltMgr_reg
push 0x550bb8
call fcn.0048d540
add esp, 8
call fcn.004878d0
test eax, eax
jne 0x4c1eb5
push eax
push eax
push str.SYSTEMCurrentControlSetServicesTsFltMgr
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c1a9b
push str.DeleteFlag
lea ecx, [ebp - 0x2c]
call fcn.00492d40
lea eax, [ebp - 0x28]
push eax
call fcn.00489080
add esp, 4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xf
call fcn.0048f160
lea ecx, [ebp - 0x28]
call fcn.0044a630
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push str.TsFltMgr.sys
lea ecx, [ebp - 0x34]
call fcn.0044f140
mov byte [ebp - 4], 0x10
call fcn.00487380
test eax, eax
je 0x4c19a2
push str.TsFltMgr_ev.sys
lea ecx, [ebp - 0x34]
call fcn.0044f4c0
lea ecx, [ebp - 0x34]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x28]
call fcn.0048f4e0
lea eax, [ebp - 0x34]
push eax
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004970c0
add esp, 0xc
lea ecx, [ebp - 0x28]
mov esi, eax
push 0
call fcn.0044a630
push eax
mov ecx, esi
call fcn.0044c0a0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x28]
call fcn.0044a630
push eax
call ebx
test eax, eax
je 0x4c1a6c
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push str.System32drivers_
push eax
call fcn.0048cb00
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
push str.ImagePath
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
push 0
push str.ErrorControl
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 0
push str.Start
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 1
push str.Type
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push str.TsFltMgr
push 0x51ba3c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
jmp 0x4c1a87
lea ecx, [ebp - 0x28]
call fcn.0044a630
push eax
push str.Not_Found__ws
push 0x550bb8
call fcn.0048d540
add esp, 0xc
lea ecx, [ebp - 0x34]
call fcn.0044c080
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a640
push str.WriteRegStr_TSKSP_..begin
push 0x550bb8
call fcn.0048d540
add esp, 8
lea ecx, [ebp - 0x2c]
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTSKSP
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00479c10
test eax, eax
je 0x4c1c0c
push str.DeleteFlag
lea ecx, [ebp - 0x2c]
call fcn.00492d40
mov ecx, edi
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x28]
call fcn.0048cfc0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x11
call fcn.0048f160
lea ecx, [ebp - 0x28]
call fcn.0044a630
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push str.TSKsp.sys
lea ecx, [ebp - 0x34]
call fcn.0044f140
mov byte [ebp - 4], 0x12
call fcn.00487380
test eax, eax
je 0x4c1b31
push str.TSKsp_ev.sys
lea ecx, [ebp - 0x34]
call fcn.0044f4c0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.004970c0
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
call ebx
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.0044c080
test esi, esi
je 0x4c1bf8
push edi
lea eax, [ebp - 0x38]
push 0x51b9fc
push eax
call fcn.0048cb00
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x13
push ecx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004970c0
add esp, 0x18
mov ecx, eax
call fcn.0044c0a0
push eax
push str.ImagePath
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x38]
call fcn.0044c080
push 0
push str.ErrorControl
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 1
push str.Start
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 1
push str.Type
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push str.TSKSP
push 0x51ba3c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0x519090
push str.autostart
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x34]
call fcn.0044c080
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a640
push str.WriteRegStr_TSKSP_..end
push 0x550bb8
call fcn.0048d540
add esp, 8
lea ecx, [ebp - 0x2c]
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTSSysKit
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00479c10
test eax, eax
je 0x4c1d55
push str.DeleteFlag
lea ecx, [ebp - 0x2c]
call fcn.00492d40
mov ecx, edi
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x28]
call fcn.0048cfc0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x14
call fcn.0048f160
lea ecx, [ebp - 0x28]
call fcn.0044a630
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0x51c0a4
lea ecx, [ebp - 0x34]
call fcn.0044f140
mov byte [ebp - 4], 0x15
call fcn.00487380
test eax, eax
je 0x4c1ca2
push str.TSSysKit_ev.sys
lea ecx, [ebp - 0x34]
call fcn.0044f4c0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.004970c0
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
call ebx
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.0044c080
test esi, esi
je 0x4c1d41
push edi
lea eax, [ebp - 0x38]
push 0x51b9fc
push eax
call fcn.0048cb00
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x16
push ecx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004970c0
add esp, 0x18
mov ecx, eax
call fcn.0044c0a0
push eax
push str.ImagePath
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x38]
call fcn.0044c080
push 0
push str.ErrorControl
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 1
push str.Start
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 1
push str.Type
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
lea ecx, [ebp - 0x34]
call fcn.0044c080
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a640
push str.QMIEProtect.sys
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0048c050
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
call ebx
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.0044c080
test esi, esi
je 0x4c1eb5
push 0
push 0
push str.SYSTEMCurrentControlSetServicesQMIEProtect
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c1eb5
push str.DeleteFlag
lea ecx, [ebp - 0x2c]
call fcn.00492d40
mov ecx, edi
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x28]
call fcn.0048cfc0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
call fcn.0048f160
lea ecx, [ebp - 0x28]
call fcn.0044a630
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push str.QMIEProtect.sys
lea ecx, [ebp - 0x30]
call fcn.0044f140
mov byte [ebp - 4], 0x18
call fcn.00487380
test eax, eax
je 0x4c1e07
push str.QMIEProtect_ev.sys
lea ecx, [ebp - 0x30]
call fcn.0044f4c0
push edi
lea eax, [ebp - 0x3c]
push 0x51b9fc
push eax
call fcn.0048cb00
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x19
push ecx
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004970c0
add esp, 0x18
mov ecx, eax
call fcn.0044c0a0
push eax
push str.ImagePath
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x38]
call fcn.0044c080
lea ecx, [ebp - 0x3c]
call fcn.0044c080
push 0
push str.ErrorControl
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 2
push str.Start
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push 1
push str.Type
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
push str.QMIEProtect
push 0x51ba3c
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
push 0x519090
push str.autostart
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a640
call fcn.004878d0
test eax, eax
je 0x4c1f23
push 0
push 0
push str.SYSTEMCurrentControlSetServicesQQSysMonX64
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c10
test eax, eax
je 0x4c1f23
push str.DeleteFlag
lea ecx, [ebp - 0x2c]
call fcn.00492d40
mov ecx, edi
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x28]
call fcn.0048cfc0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1a
call fcn.0048f160
lea ecx, [ebp - 0x28]
call fcn.0044a630
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492cf0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a640
mov ecx, 0x553028
call fcn.004b1720
test eax, eax
jne 0x4c1fcd
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x38], eax
call fcn.00479be0
push 0
push 1
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x1b
call fcn.00479c10
test eax, eax
je 0x4c1fc5
lea eax, [ebp - 0x38]
push eax
push str.SupplyID
lea ecx, [ebp - 0x30]
call fcn.00479d20
mov eax, dword [ebp - 0x38]
cmp eax, 0x7270e00
jb 0x4c1f80
cmp eax, 0x7bfa47f
jbe 0x4c1f8c
add eax, 0xfffe2b3f
cmp eax, 0x270e
ja 0x4c1fc5
call fcn.004878d0
lea ecx, [ebp - 0x2c]
push 0
push 0
test eax, eax
jne 0x4c1fa3
push str.SYSTEMCurrentControlSetServicesQQSysMon
jmp 0x4c1fa8
push str.SYSTEMCurrentControlSetServicesQQSysMonX64
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00479c10
test eax, eax
je 0x4c1fc5
push 3
push str.spvalue
lea ecx, [ebp - 0x2c]
call fcn.00492cc0
lea ecx, [ebp - 0x30]
call fcn.00479bf0
lea ecx, [ebp - 0x2c]
call fcn.00479bf0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004de51d
mov esp, ebp
pop ebp
ret