Function at 0x488c00
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66daf1
mov eax, dword fs:[0]
push eax
sub esp, 0x284
mov eax, dword [0x718924]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x274]
push eax
push 0x20019
push 0
push str.SOFTWARETencentQQPCMgr
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x488cbc
lea eax, [ebp - 0x278]
mov dword [ebp - 0x27c], 1
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x278], 0x200
push eax
lea eax, [ebp - 0x27c]
push eax
push 0
push str.InstallDir
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x488d04
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 7
mov edx, dword [ebp - 0x220]
cmp edx, 8
jb 0x489058
mov ecx, dword [ebp - 0x234]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x48904e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x489076
jmp 0x48904e
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x234]
call fcn.00472510
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.QQPCRTP.exe
call fcn.0048b430
add esp, 4
test al, al
jne 0x488cbc
push 0
call fcn.004f2e6b
push 0x100
mov dword [ebp - 0x290], eax
lea eax, [ebp - 0x114]
push 0
push eax
mov dword [ebp - 0x28c], edx
call fcn.004e30c0
push 0
push 0x80
lea eax, [ebp - 0x114]
push eax
push dword [0x718658]
call fcn.00468170
add esp, 0x20
cmp word [ebp - 0x114], 0
je 0x488e27
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x288], 0
push eax
lea eax, [ebp - 0x278]
mov dword [ebp - 0x284], 0
push eax
lea eax, [ebp - 0x280]
mov dword [ebp - 0x274], 0
push eax
lea eax, [ebp - 0x274]
mov dword [ebp - 0x280], 0
push eax
lea eax, [ebp - 0x284]
mov dword [ebp - 0x278], 0
push eax
lea eax, [ebp - 0x288]
mov dword [ebp - 0x27c], 0
push eax
lea eax, [ebp - 0x114]
push str._d__d__d__d:_d:_d
push eax
call fcn.00462340
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.004f6d9f
xor ecx, ecx
add esp, 0x28
test eax, eax
cmove ecx, dword [ebp - 0x264]
cmp dword [ebp - 0x274], ecx
je 0x488cbc
call fcn.0046ae10
test al, al
je 0x489044
call fcn.0046b2e0
test al, al
je 0x488e57
call fcn.0046b2e0
test al, al
je 0x489044
call fcn.0046b0f0
test al, al
jne 0x489044
call fcn.0048afc0
test al, al
jne 0x488e6a
mov esi, 4
jmp 0x488cc1
push 0x68164c
lea ecx, [ebp - 0x234]
call fcn.00452e20
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push eax
call fcn.00463740
add esp, 4
test al, al
jne 0x488ea5
mov esi, 2
jmp 0x488cc1
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.004e30c0
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x488ed9
lea esi, [eax + 2]
jmp 0x488cc1
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x264]
call fcn.004514e0
push str.cmd.exe
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 1
call fcn.00452e20
cmp dword [ebp - 0x250], 8
lea eax, [ebp - 0x264]
cmovae eax, dword [ebp - 0x264]
push eax
call fcn.004b3c60
add esp, 4
test eax, eax
jne 0x488f33
lea ecx, [ebp - 0x264]
lea esi, [eax + 2]
call fcn.00448fb0
jmp 0x488cc1
push 0x68167c
lea ecx, [ebp - 0x24c]
call fcn.004514e0
push 0x67b150
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 2
call fcn.00452e20
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
push dword [ebp - 0x224]
cmovae eax, dword [ebp - 0x234]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0044e7a0
push 0x67b150
lea ecx, [ebp - 0x24c]
call fcn.00452e20
push str.__ext17__cid940001__sid940001
lea ecx, [ebp - 0x24c]
call fcn.00452e20
cmp dword [ebp - 0x238], 8
lea ecx, [ebp - 0x24c]
push 0
cmovae ecx, dword [ebp - 0x24c]
lea eax, [ebp - 0x264]
cmp dword [ebp - 0x250], 8
push 0
cmovae eax, dword [ebp - 0x264]
push ecx
push eax
push 0x67c78c
push 0
call fcn.004b2ed0
add esp, 0x18
xor esi, esi
test eax, eax
je 0x489029
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
push 0x1388
call ebx
push str.QQPCRTP.exe
call fcn.0048b430
add esp, 4
test al, al
jne 0x489024
push str.QQRepair.exe
call fcn.0048b430
add esp, 4
test al, al
jne 0x489017
inc esi
cmp esi, 6
jge 0x48901d
inc edi
cmp edi, 0xc
jl 0x488fe8
mov esi, 6
jmp 0x489029
mov esi, 1
lea ecx, [ebp - 0x24c]
call fcn.00448fb0
lea ecx, [ebp - 0x264]
call fcn.00448fb0
jmp 0x488cc1
mov esi, 3
jmp 0x488cc1
push edx
push ecx
call fcn.004cb4db
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cb998
mov esp, ebp
pop ebp
ret
call fcn.004e6589
int3