Function at 0x410760
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46bc9c
mov eax, dword fs:[0]
push eax
sub esp, 0xa50
mov eax, dword [0x48f244]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4962a0], 0
jne 0x410e82
mov ebx, dword [ebp + 8]
test bl, 0x10
jne 0x4107c0
call fcn.00410ee0
test eax, eax
je 0x4107c0
mov ecx, 0x484810
call fcn.0040f680
mov eax, 0x10
jmp 0x410e87
or edi, 0xffffffff
test bl, 0x20
jne 0x410918
call fcn.00407b60
mov ecx, eax
test ecx, ecx
je 0x410ea5
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0xa40], esi
push 0x208
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00444b80
add esp, 0xc
lea eax, [ebp - 0xa54]
push eax
push 0x20019
push 0
push str.SOFTWAREHuorongSysdiag
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4108fa
mov dword [ebp - 0xa48], eax
lea eax, [ebp - 0xa44]
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0xa44], 0x104
push eax
lea eax, [ebp - 0xa48]
push eax
push 0
push str.InstallPath
push dword [ebp - 0xa54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410880
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0xa40]
call fcn.0040f890
lea eax, [ebp - 0xa40]
push str._binHipsTray.exe
push eax
call fcn.0040fa00
mov esi, dword [ebp - 0xa40]
add esp, 8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4108fa
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4108e6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x484818
call fcn.0040f680
mov eax, 0x20
jmp 0x410e87
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x410918
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test bl, 0x40
jne 0x410a65
call fcn.00407b60
mov ecx, eax
test ecx, ecx
je 0x410eaf
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0xa40], esi
push 0x208
lea eax, [ebp - 0x424]
mov dword [ebp - 4], 1
push 0
push eax
call fcn.00444b80
add esp, 0xc
lea eax, [ebp - 0xa54]
push eax
push 0x20019
push 0
push str.SOFTWAREkingsoftkwspriEx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x410a47
mov dword [ebp - 0xa44], eax
lea eax, [ebp - 0xa48]
push eax
lea eax, [ebp - 0x424]
mov dword [ebp - 0xa48], 0x104
push eax
lea eax, [ebp - 0xa44]
push eax
push 0
push str.path
push dword [ebp - 0xa54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x424]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4109d0
sub ecx, edx
lea eax, [ebp - 0x424]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0xa40]
call fcn.0040f890
lea eax, [ebp - 0xa40]
push str.kismain.exe
push eax
call fcn.0040fa00
mov esi, dword [ebp - 0xa40]
add esp, 8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x410a47
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x410a33
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x484820
call fcn.0040f680
mov eax, 0x40
jmp 0x410e87
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x410a65
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
js 0x410ba1
call fcn.00407b60
mov ecx, eax
test ecx, ecx
je 0x410eb9
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0xa40], esi
push 0x208
lea eax, [ebp - 0x62c]
mov dword [ebp - 4], 2
push 0
push eax
call fcn.00444b80
add esp, 0xc
lea eax, [ebp - 0xa54]
push eax
push 0x20019
push 0
push str.SOFTWARETencentQQPCMgr
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x410b83
mov dword [ebp - 0xa44], eax
lea eax, [ebp - 0xa48]
push eax
lea eax, [ebp - 0x62c]
mov dword [ebp - 0xa48], 0x104
push eax
lea eax, [ebp - 0xa44]
push eax
push 0
push str.ExeString
push dword [ebp - 0xa54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x62c]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410b20
sub ecx, edx
lea eax, [ebp - 0x62c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0xa40]
call fcn.0040f890
mov esi, dword [ebp - 0xa40]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x410b83
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x410b6f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x484828
call fcn.0040f680
mov eax, 0x80
jmp 0x410e87
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x410ba1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, 0x100
jne 0x410bc6
call fcn.00411560
test eax, eax
je 0x410bc6
mov ecx, 0x484830
call fcn.0040f680
mov eax, 0x100
jmp 0x410e87
test ebx, 0x200
jne 0x410d15
call fcn.00407b60
mov ecx, eax
test ecx, ecx
je 0x410ec3
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0xa40], esi
push 0x208
lea eax, [ebp - 0x834]
mov dword [ebp - 4], 3
push 0
push eax
call fcn.00444b80
add esp, 0xc
lea eax, [ebp - 0xa54]
push eax
push 0x20019
push 0
push str.SOFTWARE2345PCSafe
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x410cf7
mov dword [ebp - 0xa44], eax
lea eax, [ebp - 0xa48]
push eax
lea eax, [ebp - 0x834]
mov dword [ebp - 0xa48], 0x104
push eax
lea eax, [ebp - 0xa44]
push eax
push 0
push str.Path
push dword [ebp - 0xa54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x834]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410c80
sub ecx, edx
lea eax, [ebp - 0x834]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0xa40]
call fcn.0040f890
lea eax, [ebp - 0xa40]
push str.2345SafeTray.exe
push eax
call fcn.0040fa00
mov esi, dword [ebp - 0xa40]
add esp, 8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x410cf7
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x410ce3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, str.s2345
call fcn.0040f680
mov eax, 0x200
jmp 0x410e87
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x410d15
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, 0x400
jne 0x410e60
call fcn.00407b60
mov ecx, eax
test ecx, ecx
je 0x410ecd
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0xa40], esi
push 0x208
lea eax, [ebp - 0xa3c]
mov dword [ebp - 4], 4
push 0
push eax
call fcn.00444b80
add esp, 0xc
lea eax, [ebp - 0xa58]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallA9861883_31C5_4324_BD9A_DC9527EEB675_is1
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x410e44
mov dword [ebp - 0xa50], eax
lea eax, [ebp - 0xa4c]
push eax
lea eax, [ebp - 0xa3c]
mov dword [ebp - 0xa4c], 0x104
push eax
lea eax, [ebp - 0xa50]
push eax
push 0
push str.InstallLocation
push dword [ebp - 0xa58]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xa3c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410dd0
sub ecx, edx
lea eax, [ebp - 0xa3c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0xa40]
call fcn.0040f890
lea eax, [ebp - 0xa40]
push str.LenovoTray.exe
push eax
call fcn.0040fa00
mov esi, dword [ebp - 0xa40]
add esp, 8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x410e44
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x410e33
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x484844
call fcn.0040f680
mov eax, 0x400
jmp 0x410e87
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x410e60
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, 0x800
jne 0x410e82
call fcn.004118c0
test eax, eax
je 0x410e82
mov ecx, 0x48484c
call fcn.0040f680
mov eax, 0x800
jmp 0x410e87
mov eax, dword [0x4962a0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004390b1
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407a10
push 0x80004005
call fcn.00407a10
push 0x80004005
call fcn.00407a10
push 0x80004005
call fcn.00407a10
push 0x80004005
call fcn.00407a10
int3