Function at 0x4c0480
Capabilities:
Check if file exists
Copy file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510efd
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x54b144]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004c1b40
lea ecx, [ebp - 0x2c]
call fcn.00479ad0
push 0
push 0
push str..qbox
push SysReAllocString
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00479b00
test eax, eax
je 0x4c04ed
push str.QQPCMgr.qbox
push 0x5323dc
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push 0
push 0
push str.QQPCMgr.qbox
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479b00
test eax, eax
je 0x4c0519
push 0x51ac60
push 0x5323dc
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push 0
push 0
push str.QQPCMgr.qboxDefaultIcon
push SysReAllocString
lea ecx, [ebp - 0x2c]
lea edi, [esi + 4]
call fcn.00479b00
test eax, eax
je 0x4c0565
push str.imageqbox.ico_0
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0048bbf0
add esp, 0xc
mov ecx, eax
call fcn.0044c020
push eax
push 0x5323dc
lea ecx, [ebp - 0x2c]
call fcn.004928e0
lea ecx, [ebp - 0x30]
call fcn.0044c000
push 0
push 0
push str.QQPCMgr.qbox_shell
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479b00
test eax, eax
je 0x4c0591
push 0x5323dc
push 0x5323dc
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push 0
push 0
push str.QQPCMgr.qbox_shellopen
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479b00
test eax, eax
je 0x4c05bd
push 0x51ad30
push 0x5323dc
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push 0
push 0
push str.QQPCMgr.qbox_shellcommand
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479b00
test eax, eax
je 0x4c0606
push str.QQPCFileSafe.exe___1_
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0048bbf0
add esp, 0xc
mov ecx, eax
call fcn.0044c020
push eax
push 0x5323dc
lea ecx, [ebp - 0x2c]
call fcn.004928e0
lea ecx, [ebp - 0x30]
call fcn.0044c000
push 0
push 0
push str.QMRemote
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479b00
test eax, eax
je 0x4c0680
push 0x534774
push 0x5323dc
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push edi
lea eax, [ebp - 0x38]
push 0x5343d8
push eax
call fcn.0048c6a0
push str.QMRemote.exe_
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 1
push eax
call fcn.0048bbf0
add esp, 0x18
mov ecx, eax
call fcn.0044c020
push eax
push str.URL_Protocol
lea ecx, [ebp - 0x2c]
call fcn.004928e0
lea ecx, [ebp - 0x30]
call fcn.0044c000
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.0044c000
push 0
push 0
push str.QMRemoteShell
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479b00
test eax, eax
je 0x4c06ac
push 0x5323dc
push 0x5323dc
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push 0
push 0
push str.QMRemoteShellOpen
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479b00
test eax, eax
je 0x4c06d8
push 0x5323dc
push 0x5323dc
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push 0
push 0
push str.QMRemoteShellOpenCommand
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479b00
test eax, eax
je 0x4c0740
push edi
lea eax, [ebp - 0x38]
push 0x5343d8
push eax
call fcn.0048c6a0
push str.QQPCMgr.exe___pullRemote___1_
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.0048bbf0
add esp, 0x18
mov ecx, eax
call fcn.0044c020
push eax
push 0x5323dc
lea ecx, [ebp - 0x2c]
call fcn.004928e0
lea ecx, [ebp - 0x30]
call fcn.0044c000
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.0044c000
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479b00
test eax, eax
je 0x4c083a
push 0x5343d8
lea ecx, [ebp - 0x34]
call fcn.0044f000
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.0044c020
push eax
lea ecx, [ebp - 0x34]
call fcn.0048c120
push str.QQPCTray.exe_
lea ecx, [ebp - 0x34]
call fcn.0048c120
lea ecx, [ebp - 0x34]
call fcn.0044c020
push eax
push str.DisplayIcon
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push 0x5342cc
push 0x518924
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push 0x5343d8
lea ecx, [ebp - 0x34]
call fcn.0044f380
mov ecx, edi
call fcn.0044c020
push eax
lea ecx, [ebp - 0x34]
call fcn.0048c120
push str.Uninst.exe_
lea ecx, [ebp - 0x34]
call fcn.0048c120
lea ecx, [ebp - 0x34]
call fcn.0044c020
push eax
push str.UninstallString
lea ecx, [ebp - 0x2c]
call fcn.004928e0
lea ecx, [esi + 0xc]
call fcn.0044c020
push eax
push 0x51af94
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push str.https:__guanjia.qq.com_
push str.URLInfoAbout
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push 0x51b000
push str.Publisher
lea ecx, [ebp - 0x2c]
call fcn.004928e0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.0044c000
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.004c24b0
test eax, eax
je 0x4c09aa
push edi
lea ecx, [ebp - 0x30]
call fcn.0048cc30
push str.QQPCTray.exe
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.0048c120
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x30]
call fcn.0044c020
push eax
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push edi
lea ecx, [ebp - 0x38]
call fcn.0048cc30
push str.QQPCExternal.exe
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 5
call fcn.0048c120
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x38]
call fcn.0044c020
push eax
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push edi
lea ecx, [ebp - 0x3c]
call fcn.0048cc30
push str.QQPCSoftMgr.exe
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 6
call fcn.0048c120
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x3c]
call fcn.0044c020
push eax
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push edi
lea ecx, [ebp - 0x44]
call fcn.0048cc30
push str.QMSecurityLab.exe
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 7
call fcn.0048c120
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x44]
call fcn.0044c020
push eax
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push edi
lea ecx, [ebp - 0x40]
call fcn.0048cc30
push str.QMLspPing.exe
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 8
call fcn.0048c120
push str._PERPROCESSSYSTEMDPIFORCEON_HIGHDPIAWARE
lea ecx, [ebp - 0x40]
call fcn.0044c020
push eax
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push edi
lea ecx, [ebp - 0x34]
call fcn.0048cc30
push str.NetworkMon.exe
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 9
call fcn.0048c120
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x34]
call fcn.0044c020
push eax
lea ecx, [ebp - 0x2c]
call fcn.004928e0
lea ecx, [ebp - 0x34]
call fcn.0044c000
lea ecx, [ebp - 0x40]
call fcn.0044c000
lea ecx, [ebp - 0x44]
call fcn.0044c000
lea ecx, [ebp - 0x3c]
call fcn.0044c000
lea ecx, [ebp - 0x38]
call fcn.0044c000
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.0044c000
push 0
push 0
push str.SYSTEMCurrentControlSet_servicesQQPCRTP
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479b00
test eax, eax
je 0x4c09d3
push 0
push str.RtpFlag
lea ecx, [ebp - 0x2c]
call fcn.004928b0
push 0
push 0
push str.SOFTWARETencent
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479b00
test eax, eax
je 0x4c09ff
push 0x516080
push str.QQPCFlag
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push 0
push 0
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479b00
test eax, eax
je 0x4c0b2a
lea ebx, [esi + 4]
mov ecx, ebx
call fcn.0044c020
push eax
lea ecx, [ebp - 0x28]
call fcn.0048cb60
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xa
push eax
call fcn.00487230
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.0044a620
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.004928e0
mov edi, eax
push edi
push str.WriteReg_InstallDir__Result_:__d
push 0x54bba8
call fcn.0048d0e0
add esp, 0xc
cmp dword [esi + 0x1c], 0
je 0x4c0a7c
test edi, edi
je 0x4c0a7c
mov eax, 1
jmp 0x4c0a7e
xor eax, eax
lea ecx, [esi + 0xc]
mov dword [esi + 0x1c], eax
call fcn.0044c020
push eax
push str.Version
lea ecx, [ebp - 0x2c]
call fcn.004928e0
mov edi, eax
push edi
push str.WriteReg_Version__Result_:__d
push 0x54bba8
call fcn.0048d0e0
add esp, 0xc
cmp dword [esi + 0x1c], 0
je 0x4c0abd
test edi, edi
je 0x4c0abd
mov eax, 1
jmp 0x4c0abf
xor eax, eax
push str.QQPCMgr.exe
mov dword [esi + 0x1c], eax
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.0048bbf0
add esp, 0xc
mov ecx, eax
call fcn.0044c020
push eax
push str.ExeString
lea ecx, [ebp - 0x2c]
call fcn.004928e0
lea ecx, [ebp - 0x30]
call fcn.0044c000
push 1
push str.IdleScanTip
lea ecx, [ebp - 0x2c]
call fcn.004928b0
push 0
push str.FirstRun
lea ecx, [ebp - 0x2c]
call fcn.004928b0
push 1
push str.IsTrayCrashed
lea ecx, [ebp - 0x2c]
call fcn.004928b0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a630
push 0
push 0
push str.SOFTWARETencentQQPCMgrVulFW
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479b00
test eax, eax
je 0x4c0b53
push 1
push str.bCameraProtection
lea ecx, [ebp - 0x2c]
call fcn.004928b0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479b00
test eax, eax
je 0x4c0b87
push str.QMTray
lea ecx, [ebp - 0x2c]
call fcn.00492930
push 0x51b31c
lea ecx, [ebp - 0x2c]
call fcn.00492930
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunQQDisabled
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479b00
test eax, eax
je 0x4c0bbb
push 0x51b31c
lea ecx, [ebp - 0x2c]
call fcn.00492930
push str._QQPCTray
lea ecx, [ebp - 0x2c]
call fcn.00492930
push 0
push 0
push str.QMConfigQQDoctorQQDoctorComCfg
push reloc.WS2_32.dll_closesocket
lea ecx, [ebp - 0x2c]
call fcn.00479b00
test eax, eax
je 0x4c0be2
push str.defCoveredRemoteSetting
lea ecx, [ebp - 0x2c]
call fcn.00492930
mov ecx, esi
call fcn.004c1460
call fcn.004876e0
test eax, eax
jne 0x4c0c42
push str.Set_TSKSP_autostart
push 0x54bba8
call fcn.0048d0e0
add esp, 8
lea ecx, [ebp - 0x2c]
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTSKSP
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00479b00
test eax, eax
je 0x4c0c30
push 0x516080
push str.autostart
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push str.Set_TSKSP_autostart_end
push 0x54bba8
call fcn.0048d0e0
add esp, 8
push str.Set_QQSoftMgr_reg
push 0x54bba8
call fcn.0048d0e0
add esp, 8
lea ecx, [ebp - 0x2c]
push 0
push 0
push str.SOFTWARETENCENTDeskUpdateQQSoftMgr
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00479b00
lea edi, [esi + 4]
test eax, eax
je 0x4c0d2c
push str.QQPCSoftMgr.exe
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0048bbf0
add esp, 0xc
mov ecx, eax
call fcn.0044c020
push eax
push str.ExeString
lea ecx, [ebp - 0x2c]
call fcn.004928e0
lea ecx, [ebp - 0x30]
call fcn.0044c000
lea ecx, [ebp - 0x34]
call fcn.0047d0b0
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0xb
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00479c60
test eax, eax
je 0x4c0d20
lea ecx, [ebp - 0x34]
call fcn.0048cf10
test al, al
jne 0x4c0d20
lea ecx, [ebp - 0x34]
call fcn.0044f620
test eax, eax
je 0x4c0d20
push ecx
mov ecx, esp
push edi
call fcn.0048cc30
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.004c19b0
mov ecx, eax
call fcn.0044c020
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.004928e0
lea ecx, [ebp - 0x30]
call fcn.0044c000
push str.0.500
push str.Version
lea ecx, [ebp - 0x2c]
call fcn.004928e0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.0044c000
push str.Set_TsFltMgr_reg
push 0x54bba8
call fcn.0048d0e0
add esp, 8
call fcn.004876e0
test eax, eax
jne 0x4c12e2
push eax
push eax
push str.SYSTEMCurrentControlSetServicesTsFltMgr
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479b00
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c0ec8
push str.DeleteFlag
lea ecx, [ebp - 0x2c]
call fcn.00492930
lea eax, [ebp - 0x28]
push eax
call fcn.00488e90
add esp, 4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xc
call fcn.0048ed00
lea ecx, [ebp - 0x28]
call fcn.0044a620
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push str.TsFltMgr.sys
lea ecx, [ebp - 0x34]
call fcn.0044f000
mov byte [ebp - 4], 0xd
call fcn.00487190
test eax, eax
je 0x4c0dcf
push str.TsFltMgr_ev.sys
lea ecx, [ebp - 0x34]
call fcn.0044f380
lea ecx, [ebp - 0x34]
call fcn.0044c020
push eax
lea ecx, [ebp - 0x28]
call fcn.0048f080
lea eax, [ebp - 0x34]
push eax
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00496cb0
add esp, 0xc
lea ecx, [ebp - 0x28]
mov esi, eax
push 0
call fcn.0044a620
push eax
mov ecx, esi
call fcn.0044c020
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0x30]
call fcn.0044c000
lea ecx, [ebp - 0x28]
call fcn.0044a620
push eax
call ebx
test eax, eax
je 0x4c0e99
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push str.System32drivers_
push eax
call fcn.0048c6a0
add esp, 0xc
mov ecx, eax
call fcn.0044c020
push eax
push str.ImagePath
lea ecx, [ebp - 0x2c]
call fcn.004928e0
lea ecx, [ebp - 0x30]
call fcn.0044c000
push 0
push str.ErrorControl
lea ecx, [ebp - 0x2c]
call fcn.004928b0
push 0
push str.Start
lea ecx, [ebp - 0x2c]
call fcn.004928b0
push 1
push str.Type
lea ecx, [ebp - 0x2c]
call fcn.004928b0
push str.TsFltMgr
push 0x518924
lea ecx, [ebp - 0x2c]
call fcn.004928e0
jmp 0x4c0eb4
lea ecx, [ebp - 0x28]
call fcn.0044a620
push eax
push str.Not_Found__ws
push 0x54bba8
call fcn.0048d0e0
add esp, 0xc
lea ecx, [ebp - 0x34]
call fcn.0044c000
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a630
push str.WriteRegStr_TSKSP_..begin
push 0x54bba8
call fcn.0048d0e0
add esp, 8
lea ecx, [ebp - 0x2c]
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTSKSP
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00479b00
test eax, eax
je 0x4c1039
push str.DeleteFlag
lea ecx, [ebp - 0x2c]
call fcn.00492930
mov ecx, edi
call fcn.0044c020
push eax
lea ecx, [ebp - 0x28]
call fcn.0048cb60
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xe
call fcn.0048ed00
lea ecx, [ebp - 0x28]
call fcn.0044a620
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push str.TSKsp.sys
lea ecx, [ebp - 0x34]
call fcn.0044f000
mov byte [ebp - 4], 0xf
call fcn.00487190
test eax, eax
je 0x4c0f5e
push str.TSKsp_ev.sys
lea ecx, [ebp - 0x34]
call fcn.0044f380
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.00496cb0
add esp, 0xc
mov ecx, eax
call fcn.0044c020
push eax
call ebx
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.0044c000
test esi, esi
je 0x4c1025
push edi
lea eax, [ebp - 0x38]
push 0x5188e4
push eax
call fcn.0048c6a0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x10
push ecx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00496cb0
add esp, 0x18
mov ecx, eax
call fcn.0044c020
push eax
push str.ImagePath
lea ecx, [ebp - 0x2c]
call fcn.004928e0
lea ecx, [ebp - 0x30]
call fcn.0044c000
lea ecx, [ebp - 0x38]
call fcn.0044c000
push 0
push str.ErrorControl
lea ecx, [ebp - 0x2c]
call fcn.004928b0
push 1
push str.Start
lea ecx, [ebp - 0x2c]
call fcn.004928b0
push 1
push str.Type
lea ecx, [ebp - 0x2c]
call fcn.004928b0
push str.TSKSP
push 0x518924
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push 0x516080
push str.autostart
lea ecx, [ebp - 0x2c]
call fcn.004928e0
lea ecx, [ebp - 0x34]
call fcn.0044c000
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a630
push str.WriteRegStr_TSKSP_..end
push 0x54bba8
call fcn.0048d0e0
add esp, 8
lea ecx, [ebp - 0x2c]
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTSSysKit
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00479b00
test eax, eax
je 0x4c1182
push str.DeleteFlag
lea ecx, [ebp - 0x2c]
call fcn.00492930
mov ecx, edi
call fcn.0044c020
push eax
lea ecx, [ebp - 0x28]
call fcn.0048cb60
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x11
call fcn.0048ed00
lea ecx, [ebp - 0x28]
call fcn.0044a620
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push 0x518ef0
lea ecx, [ebp - 0x34]
call fcn.0044f000
mov byte [ebp - 4], 0x12
call fcn.00487190
test eax, eax
je 0x4c10cf
push str.TSSysKit_ev.sys
lea ecx, [ebp - 0x34]
call fcn.0044f380
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.00496cb0
add esp, 0xc
mov ecx, eax
call fcn.0044c020
push eax
call ebx
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.0044c000
test esi, esi
je 0x4c116e
push edi
lea eax, [ebp - 0x38]
push 0x5188e4
push eax
call fcn.0048c6a0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x13
push ecx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00496cb0
add esp, 0x18
mov ecx, eax
call fcn.0044c020
push eax
push str.ImagePath
lea ecx, [ebp - 0x2c]
call fcn.004928e0
lea ecx, [ebp - 0x30]
call fcn.0044c000
lea ecx, [ebp - 0x38]
call fcn.0044c000
push 0
push str.ErrorControl
lea ecx, [ebp - 0x2c]
call fcn.004928b0
push 1
push str.Start
lea ecx, [ebp - 0x2c]
call fcn.004928b0
push 1
push str.Type
lea ecx, [ebp - 0x2c]
call fcn.004928b0
lea ecx, [ebp - 0x34]
call fcn.0044c000
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a630
push str.QMIEProtect.sys
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0048bbf0
add esp, 0xc
mov ecx, eax
call fcn.0044c020
push eax
call ebx
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.0044c000
test esi, esi
je 0x4c12e2
push 0
push 0
push str.SYSTEMCurrentControlSetServicesQMIEProtect
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479b00
test eax, eax
je 0x4c12e2
push str.DeleteFlag
lea ecx, [ebp - 0x2c]
call fcn.00492930
mov ecx, edi
call fcn.0044c020
push eax
lea ecx, [ebp - 0x28]
call fcn.0048cb60
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x14
call fcn.0048ed00
lea ecx, [ebp - 0x28]
call fcn.0044a620
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push str.QMIEProtect.sys
lea ecx, [ebp - 0x30]
call fcn.0044f000
mov byte [ebp - 4], 0x15
call fcn.00487190
test eax, eax
je 0x4c1234
push str.QMIEProtect_ev.sys
lea ecx, [ebp - 0x30]
call fcn.0044f380
push edi
lea eax, [ebp - 0x3c]
push 0x5188e4
push eax
call fcn.0048c6a0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x16
push ecx
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00496cb0
add esp, 0x18
mov ecx, eax
call fcn.0044c020
push eax
push str.ImagePath
lea ecx, [ebp - 0x2c]
call fcn.004928e0
lea ecx, [ebp - 0x38]
call fcn.0044c000
lea ecx, [ebp - 0x3c]
call fcn.0044c000
push 0
push str.ErrorControl
lea ecx, [ebp - 0x2c]
call fcn.004928b0
push 2
push str.Start
lea ecx, [ebp - 0x2c]
call fcn.004928b0
push 1
push str.Type
lea ecx, [ebp - 0x2c]
call fcn.004928b0
push str.QMIEProtect
push 0x518924
lea ecx, [ebp - 0x2c]
call fcn.004928e0
push 0x516080
push str.autostart
lea ecx, [ebp - 0x2c]
call fcn.004928e0
lea ecx, [ebp - 0x30]
call fcn.0044c000
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a630
call fcn.004876e0
test eax, eax
je 0x4c1350
push 0
push 0
push str.SYSTEMCurrentControlSetServicesQQSysMonX64
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479b00
test eax, eax
je 0x4c1350
push str.DeleteFlag
lea ecx, [ebp - 0x2c]
call fcn.00492930
mov ecx, edi
call fcn.0044c020
push eax
lea ecx, [ebp - 0x28]
call fcn.0048cb60
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
call fcn.0048ed00
lea ecx, [ebp - 0x28]
call fcn.0044a620
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.004928e0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a630
mov ecx, 0x54e028
call fcn.004b1150
test eax, eax
jne 0x4c13fa
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x38], eax
call fcn.00479ad0
push 0
push 1
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x18
call fcn.00479b00
test eax, eax
je 0x4c13f2
lea eax, [ebp - 0x38]
push eax
push str.SupplyID
lea ecx, [ebp - 0x30]
call fcn.00479c10
mov eax, dword [ebp - 0x38]
cmp eax, 0x7270e00
jb 0x4c13ad
cmp eax, 0x7bfa47f
jbe 0x4c13b9
add eax, 0xfffe2b3f
cmp eax, 0x270e
ja 0x4c13f2
call fcn.004876e0
lea ecx, [ebp - 0x2c]
push 0
push 0
test eax, eax
jne 0x4c13d0
push str.SYSTEMCurrentControlSetServicesQQSysMon
jmp 0x4c13d5
push str.SYSTEMCurrentControlSetServicesQQSysMonX64
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00479b00
test eax, eax
je 0x4c13f2
push 3
push str.spvalue
lea ecx, [ebp - 0x2c]
call fcn.004928b0
lea ecx, [ebp - 0x30]
call fcn.00479ae0
lea ecx, [ebp - 0x2c]
call fcn.00479ae0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dafe6
mov esp, ebp
pop ebp
ret