Function at 0x442640
Capabilities:
Check if file exists
Delete registry value
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d5700
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0041c970
push 1
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x10]
call fcn.0041c0e0
mov ecx, str.0s
mov eax, dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4426b8
test dx, dx
je 0x4426b4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4426b8
add eax, 4
add ecx, 4
test dx, dx
jne 0x442692
xor eax, eax
jmp 0x4426bd
sbb eax, eax
or eax, 1
mov edx, dword [ebp + 8]
test eax, eax
setne bl
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4426dd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x4426f0
push 1
push str.0s
lea ecx, [ebp - 0x10]
call fcn.0041c490
push 0xb
push str.QQPCRtp.exe
lea ecx, [ebp - 0x10]
call fcn.0041c490
mov esi, 3
mov dword [ebp - 0x1c], esi
cmp dword [0x515428], 0
jne 0x44271d
cmp dword [0x5153ec], 0
jne 0x442b4c
mov ecx, str.QQPCRtp.exe
call fcn.0048fe80
push 0
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesQQPCrtp
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x442b27
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], 4
test eax, eax
je 0x4427a2
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
push 0
push str.DeleteFlag
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4427a2
cmp dword [ebp - 0x2c], 4
jne 0x4427a2
mov eax, dword [ebp + 8]
test eax, eax
je 0x4427a2
push str.DeleteFlag
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
call fcn.0041bed0
test eax, eax
je 0x442c0f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
push str.ImagePath
lea ecx, [ebp + 8]
call fcn.00440780
mov ebx, dword [ebp - 0x18]
test eax, eax
je 0x442b0b
lea ecx, [ebx - 0x10]
call fcn.0041c670
lea esi, [eax + 0x10]
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 3
mov edi, dword [esi - 0xc]
test edi, edi
js 0x442c05
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x442816
push edi
lea ecx, [ebp - 0x20]
call fcn.0041cb60
mov esi, dword [ebp - 0x20]
lea eax, [edi + 1]
push eax
push esi
call fcn.004b1e32
add esp, 8
cmp edi, dword [esi - 8]
jg 0x442c05
mov dword [esi - 0xc], edi
xor eax, eax
mov word [esi + edi*2], ax
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.0041c670
lea edi, [eax + 0x10]
mov dword [ebp - 0x24], edi
mov byte [ebp - 4], 4
mov edx, dword [edi - 0xc]
mov dword [ebp - 0x28], edx
test edx, edx
js 0x442c05
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, edx
or eax, ecx
jge 0x442878
push edx
lea ecx, [ebp - 0x24]
call fcn.0041cb60
mov edi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
lea eax, [edx + 1]
push eax
push edi
call fcn.004b1e32
mov eax, dword [ebp - 0x28]
add esp, 8
cmp eax, dword [edi - 8]
jg 0x442c05
xor ecx, ecx
mov dword [edi - 0xc], eax
mov word [edi + eax*2], cx
cmp dword [esi - 0xc], ecx
jl 0x4428ba
push edi
push esi
call fcn.004a7c3e
add esp, 8
test eax, eax
je 0x4428ba
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
jne 0x442b84
push esi
push 0x4f079c
push 0x515488
call fcn.0048d1f0
push edi
push 0x4f07c8
push 0x515488
call fcn.0048d1f0
push 0x4f07e0
push 0x515488
call fcn.0048d1f0
add esp, 0x20
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44290f
mov ecx, dword [ebp - 0x10]
mov edx, 0x4f0828
push 0
push 0
push 0xffffffffffffffff
call fcn.0048fc00
add esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], 0
test eax, eax
je 0x442936
push 4
lea ecx, [ebp - 0x28]
push ecx
push 4
push 0
push str.RtpFlag
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], 0x110
test eax, eax
je 0x44295a
push 4
lea ecx, [ebp - 0x28]
push ecx
push 4
push 0
push str.Type
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], 1
test eax, eax
je 0x44297e
push 4
lea ecx, [ebp - 0x28]
push ecx
push 4
push 0
push str.ErrorControl
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], 2
test eax, eax
je 0x442a1b
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.Start
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 8]
test eax, eax
je 0x442a1b
push 0x28
push str.QQPCMgr_RTP_Service
push 1
push 0
push 0x4f03d0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 8]
test eax, eax
je 0x442a1b
push 0x26
push str.COM_Infrastructure
push 1
push 0
push 0x4f0868
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 8]
test eax, eax
je 0x442a1b
push 0x18
push str.LocalSystem
push 1
push 0
push str.ObjectName
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 8]
test eax, eax
je 0x442a1b
push 0x1a
push 0x4f08a4
push 1
push 0
push str.Description
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x4eecc0
lea ecx, [ebp - 0x14]
call fcn.0041c970
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 5
mov edx, dword [eax + 4]
test edx, edx
jne 0x442a3a
xor ecx, ecx
jmp 0x442a52
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x28], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x442a42
sub ecx, dword [ebp - 0x28]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x14]
call fcn.0041c490
push 0xf
push str.QQPCRtp.exe___r
lea ecx, [ebp - 0x14]
call fcn.0041c490
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x442ab1
mov eax, dword [ebp - 0x14]
mov ebx, eax
lea edx, [ebx + 2]
mov dword [ebp - 0x38], edx
nop dword [eax]
mov dx, word [ebx]
add ebx, 2
test dx, dx
jne 0x442a80
mov dword [ebp - 0x28], ebx
mov edx, ebx
sub edx, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x18]
sar edx, 1
lea edx, [edx*2 + 2]
push edx
push eax
push 1
push 0
push str.ImagePath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 4
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x442ad0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x442aec
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x442b08
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x1c]
mov byte [ebp - 4], 1
add ebx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x442b27
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
dec esi
mov byte [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], esi
test eax, eax
je 0x442b3d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], 0
test esi, esi
jg 0x442707
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x442b6e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.RepairQQPCRtp_RTP
push 0x515488
call fcn.0048d1f0
add esp, 8
mov byte [ebp - 4], 3
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x442bb2
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
or edi, 0xffffffff
mov byte [ebp - 4], 2
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x442bd0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
add ebx, 0xfffffff0
mov eax, edi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x442beb
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 8]
test eax, eax
je 0x442bf9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], 0
jmp 0x442b4c
push 0x80070057
call fcn.0041cdf0
push 0x80004005
call fcn.0041cdf0
int3