Function at 0x10001290
Capabilities:
Get file version info
Terminate thread

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10c
push ebx
push ebp
mov ebp, 1
push esi
cmp eax, ebp
push edi
jne 0x100016ac
mov esi, dword [esp + 0x120]
push esi
push 0x1004c428
call sub.MFC42.DLL_AfxInitExtensionModule
test eax, eax
je 0x100013ea
push 0x40
call sub.MFC42.DLL_operatornew
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x100012e2
push ebx
push 0x1004c428
mov ecx, eax
call sub.MFC42.DLL_CDynLinkLibrary::CDynLinkLibrary
mov dword [0x1000f2b4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.KernelUtil.dll
call esi
test eax, eax
je 0x1000149f
push 0x1000d244
call fcn.10002c40
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], bl
rep stosd dword es:[edi], eax
add esp, 4
stosw word es:[edi], ax
push str.QQ.exe
stosb byte es:[edi], al
call esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x10001428
lea edx, [esp + 0x18]
push edx
push str.get_qq_szPath:__s
call fcn.10002c40
add esp, 8
lea eax, [esp + 0x18]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
jne 0x1000138d
push str.Error_in_GetFileVersionInfoSize
call fcn.10002c40
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
push esi
call sub.MFC42.DLL_operatornew
add esp, 4
mov edi, eax
lea ecx, [esp + 0x18]
push edi
push esi
push ebx
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x100013b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_in_GetFileVersionInfo:__d_n
jmp 0x100013dc
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
push 0x1000d1e0
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x100013f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_in_VerQueryValue:__d_n
call fcn.10002c40
push edi
call sub.MFC42.DLL_operatordelete
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret 0xc
mov ecx, dword [esp + 0x10]
cmp dword [ecx + 8], 0x1004b
jb 0x1000141b
push str.QQ2012
call fcn.10002c40
add esp, 4
mov dword [0x1004c414], ebp
jmp 0x10001428
push str.QQ2009___QQ2011
call fcn.10002c40
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x1000f298
call esi
push 0x1000f280
call esi
call fcn.10006590
test eax, eax
jne 0x10001461
push str.Setup_Api_Hook_Failed_
call fcn.10002c40
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
push str.Setup_Api_Success_
call fcn.10002c40
add esp, 4
call fcn.100017c0
test eax, eax
jne 0x10001484
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
mov dword [0x1004c3ec], ebp
mov dword [0x1004c3f4], 3
mov dword [0x1004c3e8], ebp
jmp 0x10001585
push str.QQ.exe
call esi
test eax, eax
je 0x100014d7
call fcn.100017c0
test eax, eax
jne 0x100014c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
mov dword [0x1004c3ec], ebp
mov dword [0x1004c3f4], ebp
mov dword [0x1004c3e8], ebp
jmp 0x10001585
push str.TM.exe
call esi
test eax, eax
je 0x10001510
call fcn.100017c0
test eax, eax
jne 0x100014f8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
mov dword [0x1004c3ec], ebp
mov dword [0x1004c3f4], 2
mov dword [0x1004c3e8], ebp
jmp 0x10001585
push str.WLDCore.dll
call esi
test eax, eax
je 0x100015b9
push 0x1000d15c
call fcn.10002c40
add esp, 4
push str.ShellDll.dll
call esi
test eax, eax
je 0x1000169d
call fcn.100017c0
test eax, eax
jne 0x10001551
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
mov dword [0x1004c3ec], 0x10
mov dword [0x1004c3f8], 4
mov dword [0x1004c3e8], ebp
push 0x1000d134
call fcn.10002c40
mov eax, dword [0x1004c3e8]
add esp, 4
cmp eax, ebx
je 0x100017a2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x1004c3f0], eax
mov ecx, 0xd2
xor eax, eax
mov edi, 0x1004c018
rep stosd dword es:[edi], eax
mov ecx, 0x21
mov edi, 0x1004c360
rep stosd dword es:[edi], eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
push str.MSNCore.dll
call esi
test eax, eax
je 0x1000161a
push 0x1000d118
call fcn.10002c40
add esp, 4
push str.ShellDll.dll
call esi
test eax, eax
je 0x1000169d
call fcn.100017c0
test eax, eax
jne 0x100015f6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
mov dword [0x1004c3ec], 0x10
mov dword [0x1004c3f8], 3
mov dword [0x1004c3e8], ebp
push 0x1000d100
jmp 0x10001570
push str.Skype.exe
call esi
test eax, eax
je 0x10001663
push 0x1000d0e8
call fcn.10002c40
add esp, 4
call fcn.100017c0
test eax, eax
jne 0x10001648
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
mov dword [0x1004c3ec], 0x100
mov dword [0x1004c3fc], ebp
mov dword [0x1004c3e8], ebp
jmp 0x10001585
push str.NscAuth.exe
call esi
test eax, eax
je 0x10001690
push 0x1000d0cc
call fcn.10002c40
add esp, 4
mov eax, ebp
mov dword [0x1004c3e8], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
push 0x1000d0b8
call fcn.10002c40
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret 0xc
xor ebx, ebx
cmp eax, ebx
jne 0x1000175b
cmp dword [0x1004c3e8], ebx
je 0x10001734
call fcn.10001ad0
cmp dword [0x1004c3ec], ebp
jne 0x100016fa
cmp dword [0x1004c3f4], 3
jne 0x100016fa
call fcn.10006650
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x1000f298
call esi
push 0x1000f280
call esi
push str.QQ2009_UnHook_API_
call fcn.10002c40
add esp, 4
mov eax, dword [0x1004c3e4]
cmp eax, ebx
je 0x1000171e
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push str.Terminate_Net_Transe_Thread
mov dword [0x1004c3e4], ebx
call fcn.10002c40
add esp, 4
mov eax, dword [0x10034f48]
cmp eax, ebx
je 0x10001734
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10034f48], ebx
push str.Audit_Moudle_Process_DETACH_
call fcn.10002c40
add esp, 4
push ebx
push 0x1004c428
call sub.MFC42.DLL_AfxTermExtensionModule
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
cmp eax, 3
jne 0x10001767
push str.DLL_THREAD_DETACH
jmp 0x1000179a
cmp eax, 2
jne 0x100017a2
cmp dword [0x1004c3e8], ebx
je 0x100017a2
cmp dword [0x1000f2b8], ebx
je 0x10001784
cmp dword [0x1000f2c0], ebx
jne 0x100017a2
cmp dword [0x1000f2c4], ebx
jne 0x100017a2
call fcn.10001830
test eax, eax
jne 0x100017a2
push 0x1000d040
call fcn.10002c40
add esp, 4
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc