Function at 0x41a820
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get startup folder
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474f9b
mov eax, dword fs:[0]
push eax
sub esp, 0x71c
mov eax, dword [0x498068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x724], ecx
lea ecx, [ebp - 0x688]
mov dword [ebp - 0x728], 0
xor edi, edi
call fcn.00401900
push 0x208
lea eax, [ebp - 0x420]
mov dword [ebp - 4], edi
push edi
push eax
call fcn.00452a30
mov byte [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x660], edi
mov dword [ebp - 0x65c], edi
mov dword [ebp - 0x660], edi
mov dword [ebp - 0x65c], 7
mov word [ebp - 0x670], ax
push 0x208
push eax
lea eax, [ebp - 0x628]
mov byte [ebp - 4], 2
push eax
call fcn.00452a30
add esp, 0x18
lea eax, [ebp - 0x628]
push edi
push 0x2b
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x628]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a8e0
sub ecx, edx
lea eax, [ebp - 0x628]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x670]
call fcn.00401a50
push 7
xor eax, eax
mov dword [ebp - 0x6a8], 0
mov dword [ebp - 0x6a4], 0
lea ecx, [ebp - 0x6b8]
push 0x484908
mov dword [ebp - 0x6a8], 0
mov dword [ebp - 0x6a4], 7
mov word [ebp - 0x6b8], ax
call fcn.00401a50
lea eax, [ebp - 0x670]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x658]
call fcn.00401920
lea eax, [ebp - 0x6b8]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x718]
push eax
lea ecx, [ebp - 0x658]
call fcn.00427150
lea ecx, [ebp - 0x700]
mov byte [ebp - 4], 5
push ecx
mov ecx, eax
call fcn.00427430
push eax
lea ecx, [ebp - 0x6e8]
mov byte [ebp - 4], 6
call fcn.00401920
lea ecx, [ebp - 0x6e8]
call fcn.00427330
lea ecx, [ebp - 0x700]
mov byte [ebp - 4], 8
call fcn.00401850
lea ecx, [ebp - 0x718]
mov byte [ebp - 4], 9
call fcn.00401850
lea ecx, [ebp - 0x658]
mov byte [ebp - 4], 0xa
call fcn.00401850
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x6a4]
cmp edx, 8
jb 0x41aa16
mov ecx, dword [ebp - 0x6b8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41aa0c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b8f2
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x6a8], 0
mov dword [ebp - 0x6a4], 7
mov word [ebp - 0x6b8], ax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x640]
push 0x1b
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x62c], eax
push str.QQProtectBinQQProtect.exe
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
call fcn.00401a50
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x6a0]
push eax
lea ecx, [ebp - 0x6e8]
call fcn.00427150
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0x11
cmp ecx, eax
je 0x41aab0
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x41aaa1
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x688]
call fcn.00401a50
lea ecx, [ebp - 0x6a0]
mov byte [ebp - 4], 0x10
call fcn.00401850
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x62c]
cmp edx, 8
jb 0x41ab03
mov ecx, dword [ebp - 0x640]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41aaf9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b8f7
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0xb
call fcn.00401810
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call ebx
cmp eax, 0xffffffff
je 0x41abb7
lea ecx, [ebp - 0x6e8]
mov byte [ebp - 4], 2
mov edi, 1
call fcn.00401850
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x65c]
cmp edx, 8
jb 0x41ab95
mov ecx, dword [ebp - 0x670]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41ab8b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b8fc
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x65c], 7
mov word [ebp - 0x670], ax
jmp 0x41b77c
cmp dword [0x49badc], 0
jne 0x41abf4
push 0x28
call fcn.00450175
add esp, 4
mov ecx, eax
call fcn.00425160
push 0
mov esi, eax
push esi
push 0x49badc
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x41abf4
test esi, esi
je 0x41abf4
push 0x28
push esi
call fcn.004501a5
add esp, 8
mov eax, dword [0x49badc]
mov edx, str.SYSTEMCurrentControlSet_servicesQQProtectX64
mov ecx, str.SYSTEMCurrentControlSet_servicesQQProtect
cmp dword [eax + 0x24], 1
lea eax, [ebp - 0x71c]
push eax
push 0x20019
push 0
cmove ecx, edx
mov dword [ebp - 0x71c], 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41b283
mov esi, dword [ebp - 0x71c]
test esi, esi
je 0x41b27d
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x720], 0x208
push 0
push eax
call fcn.00452a30
add esp, 0xc
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push str.QPPath
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
test eax, eax
jne 0x41adcd
mov eax, dword [ebp - 0x720]
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x41b90b
xor ecx, ecx
mov dword [ebp - 0x630], ecx
mov word [ebp + eax - 0x218], cx
xor eax, eax
mov dword [ebp - 0x62c], ecx
mov dword [ebp - 0x630], ecx
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x62c], 7
lea edx, [ecx + 2]
mov word [ebp - 0x640], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41ace0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x640]
call fcn.00401a50
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0x658]
call fcn.00401920
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x658]
cmp dword [ebp - 0x644], 8
lea ecx, [ebp - 0x688]
push dword [ebp - 0x648]
cmovae eax, dword [ebp - 0x658]
push eax
call fcn.00401a50
lea ecx, [ebp - 0x658]
mov byte [ebp - 4], 0x1a
call fcn.00401850
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0x62c]
cmp edx, 8
jb 0x41ad95
mov ecx, dword [ebp - 0x640]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41ad8b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b901
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0xb
call fcn.00401810
push eax
call ebx
cmp eax, 0xffffffff
jne 0x41b1f3
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x420]
push eax
push 0
push 0
push str.Path
push dword [ebp - 0x71c]
call esi
test eax, eax
jne 0x41b1f8
mov eax, dword [ebp - 0x720]
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x41b90b
xor ecx, ecx
mov word [ebp + eax - 0x420], cx
xor eax, eax
mov dword [ebp - 0x648], ecx
mov dword [ebp - 0x644], ecx
push 0x1b
mov dword [ebp - 0x648], ecx
lea ecx, [ebp - 0x658]
push str.QQProtectBinQQProtect.exe
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
call fcn.00401a50
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x420]
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41ae87
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x640]
call fcn.00401a50
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00401920
lea eax, [ebp - 0x658]
mov byte [ebp - 4], 0x22
push eax
lea eax, [ebp - 0x6d0]
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00427150
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0x23
cmp ecx, eax
je 0x41af03
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x41aef4
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x688]
call fcn.00401a50
lea ecx, [ebp - 0x6d0]
mov byte [ebp - 4], 0x22
call fcn.00401850
lea ecx, [ebp - 0x6a0]
mov byte [ebp - 4], 0x21
call fcn.00401850
mov byte [ebp - 4], 0x24
mov edx, dword [ebp - 0x62c]
cmp edx, 8
jb 0x41af65
mov ecx, dword [ebp - 0x640]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41af5b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b906
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
mov byte [ebp - 4], 0x28
mov edx, dword [ebp - 0x644]
cmp edx, 8
jb 0x41afc6
mov ecx, dword [ebp - 0x658]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41afbc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b910
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0xb
call fcn.00401810
push eax
call ebx
cmp eax, 0xffffffff
jne 0x41b1f3
push 0x1f
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 0
lea ecx, [ebp - 0x640]
push str.BinQQProtectBinQQProtect.exe
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
call fcn.00401a50
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x420]
xor eax, eax
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b080
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x658]
call fcn.00401a50
lea eax, [ebp - 0x658]
mov byte [ebp - 4], 0x2d
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00401920
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0x2e
push eax
lea eax, [ebp - 0x6d0]
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00427150
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0x2f
cmp ecx, eax
je 0x41b0fc
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x41b0ed
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x688]
call fcn.00401a50
lea ecx, [ebp - 0x6d0]
mov byte [ebp - 4], 0x2e
call fcn.00401850
lea ecx, [ebp - 0x6a0]
mov byte [ebp - 4], 0x2d
call fcn.00401850
mov byte [ebp - 4], 0x30
mov edx, dword [ebp - 0x644]
cmp edx, 8
jb 0x41b15e
mov ecx, dword [ebp - 0x658]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41b154
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b915
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
mov byte [ebp - 4], 0x34
mov edx, dword [ebp - 0x62c]
cmp edx, 8
jb 0x41b1bf
mov ecx, dword [ebp - 0x640]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41b1b5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b91a
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0xb
call fcn.00401810
push eax
call ebx
cmp eax, 0xffffffff
je 0x41b1f8
mov edi, 1
push dword [ebp - 0x71c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x41b283
lea ecx, [ebp - 0x6e8]
mov byte [ebp - 4], 2
call fcn.00401850
mov byte [ebp - 4], 0x38
mov edx, dword [ebp - 0x65c]
cmp edx, 8
jb 0x41b25b
mov ecx, dword [ebp - 0x670]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41b251
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b91f
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x65c], 7
mov word [ebp - 0x670], ax
jmp 0x41b77c
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x71c]
mov dword [ebp - 0x71c], 0
push eax
push 0x20019
push 0
push str.SOFTWARETencentQQ2009
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41b7b2
mov eax, dword [ebp - 0x71c]
test eax, eax
je 0x41b7b2
lea ecx, [ebp - 0x720]
mov dword [ebp - 0x720], 0x208
push ecx
lea ecx, [ebp - 0x420]
push ecx
push 0
push 0
push str.Install
push eax
call esi
test eax, eax
jne 0x41b6f8
mov eax, dword [ebp - 0x720]
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x41b90b
xor ecx, ecx
mov word [ebp + eax - 0x420], cx
xor eax, eax
mov dword [ebp - 0x630], ecx
mov dword [ebp - 0x62c], ecx
push 0x1b
mov dword [ebp - 0x630], ecx
lea ecx, [ebp - 0x640]
push str.QQProtectBinQQProtect.exe
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
call fcn.00401a50
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x420]
xor eax, eax
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b380
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x658]
call fcn.00401a50
lea eax, [ebp - 0x658]
mov byte [ebp - 4], 0x3d
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00401920
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0x3e
push eax
lea eax, [ebp - 0x6d0]
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00427150
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0x3f
cmp ecx, eax
je 0x41b3fc
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x41b3ed
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x688]
call fcn.00401a50
lea ecx, [ebp - 0x6d0]
mov byte [ebp - 4], 0x3e
call fcn.00401850
lea ecx, [ebp - 0x6a0]
mov byte [ebp - 4], 0x3d
call fcn.00401850
mov byte [ebp - 4], 0x40
mov edx, dword [ebp - 0x644]
cmp edx, 8
jb 0x41b45e
mov ecx, dword [ebp - 0x658]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41b454
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b924
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
mov byte [ebp - 4], 0x44
mov edx, dword [ebp - 0x62c]
cmp edx, 8
jb 0x41b4bf
mov ecx, dword [ebp - 0x640]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41b4b5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b929
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0xb
call fcn.00401810
push eax
call ebx
cmp eax, 0xffffffff
jne 0x41b6f3
push 0x1f
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 0
lea ecx, [ebp - 0x640]
push str.BinQQProtectBinQQProtect.exe
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
call fcn.00401a50
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x420]
xor eax, eax
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b580
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x658]
call fcn.00401a50
lea eax, [ebp - 0x658]
mov byte [ebp - 4], 0x49
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00401920
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0x4a
push eax
lea eax, [ebp - 0x6d0]
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00427150
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0x4b
cmp ecx, eax
je 0x41b5fc
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x41b5ed
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x688]
call fcn.00401a50
lea ecx, [ebp - 0x6d0]
mov byte [ebp - 4], 0x4a
call fcn.00401850
lea ecx, [ebp - 0x6a0]
mov byte [ebp - 4], 0x49
call fcn.00401850
mov byte [ebp - 4], 0x4c
mov edx, dword [ebp - 0x644]
cmp edx, 8
jb 0x41b65e
mov ecx, dword [ebp - 0x658]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41b654
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b92e
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
mov byte [ebp - 4], 0x50
mov edx, dword [ebp - 0x62c]
cmp edx, 8
jb 0x41b6bf
mov ecx, dword [ebp - 0x640]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41b6b5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b933
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0xb
call fcn.00401810
push eax
call ebx
cmp eax, 0xffffffff
je 0x41b6f8
mov edi, 1
push dword [ebp - 0x71c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x41b7b2
lea ecx, [ebp - 0x6e8]
mov byte [ebp - 4], 2
call fcn.00401850
mov byte [ebp - 4], 0x54
mov edx, dword [ebp - 0x65c]
cmp edx, 8
jb 0x41b75f
mov ecx, dword [ebp - 0x670]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41b755
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b938
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x65c], 7
mov word [ebp - 0x670], ax
mov ebx, dword [ebp - 0x724]
lea eax, [ebp - 0x688]
mov byte [ebp - 4], 0
cmp ebx, eax
je 0x41b82b
cmp dword [ebp - 0x674], 8
mov ecx, ebx
push dword [ebp - 0x678]
cmovae eax, dword [ebp - 0x688]
push eax
call fcn.00401a50
jmp 0x41b82b
lea ecx, [ebp - 0x6e8]
mov byte [ebp - 4], 2
call fcn.00401850
mov byte [ebp - 4], 0x58
mov edx, dword [ebp - 0x65c]
cmp edx, 8
jb 0x41b805
mov ecx, dword [ebp - 0x670]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41b7fb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b93d
push edx
push ecx
call fcn.004501a5
add esp, 8
xor eax, eax
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x65c], 7
mov word [ebp - 0x670], ax
mov ebx, dword [ebp - 0x724]
mov byte [ebp - 4], al
cmp dword [0x49ad28], 0
jg 0x41b8a7
sub esp, 8
mov dword [ebp - 0xc0], 0
lea ecx, [ebp - 0xb8]
call fcn.004235a0
mov dword [ebp - 0x1c], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetuputilqpqq_protect.cpp
mov dword [ebp - 0x18], 0x85
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x85
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3hummersetuputilqpqq_protect.cpp
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x14], eax
call fcn.00426000
mov byte [ebp - 4], 0x5c
mov dword [ebp - 0x728], 1
cmp dword [ebx + 0x14], 8
jb 0x41b88e
mov ebx, dword [ebx]
mov edx, str.GetQQProtectFilePath:
lea ecx, [ebp - 0xb8]
call fcn.00407b40
mov edx, ebx
mov ecx, eax
call fcn.004263f0
mov dword [ebp - 4], 0
test byte [ebp - 0x728], 1
je 0x41b8c2
lea ecx, [ebp - 0xc0]
call fcn.00425b00
lea ecx, [ebp - 0x688]
mov dword [ebp - 4], 0xffffffff
call fcn.00401850
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00450164
mov esp, ebp
pop ebp
ret
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.00450305
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
call fcn.0045559f
int3