Function at 0x446e30
Capabilities:
Check if file exists
Delete registry value
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4691f4
mov eax, dword fs:[0]
push eax
sub esp, 0xc9c
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x140], 0
mov ecx, 9
mov esi, 0x475920
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x475944]
mov dword [ebp - 0x1a8], eax
mov ecx, dword [0x475948]
mov dword [ebp - 0x1a4], ecx
mov edx, dword [0x47594c]
mov dword [ebp - 0x1a0], edx
mov eax, dword [0x475950]
mov dword [ebp - 0x19c], eax
mov ecx, dword [0x475954]
mov dword [ebp - 0x198], ecx
mov edx, dword [0x475958]
mov dword [ebp - 0x194], edx
mov eax, dword [0x47595c]
mov dword [ebp - 0x428], eax
mov ecx, dword [0x475960]
mov dword [ebp - 0x424], ecx
mov edx, dword [0x475964]
mov dword [ebp - 0x420], edx
mov eax, dword [0x475968]
mov dword [ebp - 0x41c], eax
mov ecx, dword [0x47596c]
mov dword [ebp - 0x418], ecx
mov dx, word [0x475970]
mov word [ebp - 0x414], dx
mov eax, dword [0x475974]
mov dword [ebp - 0x28], eax
mov ecx, dword [0x475978]
mov dword [ebp - 0x24], ecx
mov edx, dword [0x47597c]
mov dword [ebp - 0x20], edx
mov eax, dword [0x475980]
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x475984]
mov dword [ebp - 0x18], ecx
mov dx, word [0x475988]
mov word [ebp - 0x14], dx
mov ecx, 9
mov esi, 0x47598c
lea edi, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 7
mov esi, 0x4759b4
lea edi, [ebp - 0x1c8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 8
mov esi, 0x4759d4
lea edi, [ebp - 0x410]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0xa
mov esi, 0x4759f8
lea edi, [ebp - 0x190]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 8
mov esi, 0x475a24
lea edi, [ebp - 0x164]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [0x475a48]
mov dword [ebp - 0x1e0], eax
mov ecx, dword [0x475a4c]
mov dword [ebp - 0x1dc], ecx
mov edx, dword [0x475a50]
mov dword [ebp - 0x1d8], edx
mov eax, dword [0x475a54]
mov dword [ebp - 0x1d4], eax
mov ecx, dword [0x475a58]
mov dword [ebp - 0x1d0], ecx
mov dx, word [0x475a5c]
mov word [ebp - 0x1cc], dx
lea ecx, [ebp - 0x458]
call fcn.00401190
mov dword [ebp - 4], 0
lea eax, [ebp - 0x458]
push eax
call fcn.00451340
add esp, 4
push 0x4880d0
call fcn.00445bd0
add esp, 4
push 0x486708
call fcn.00414d31
add esp, 4
test eax, eax
jbe 0x447054
push 0x486708
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x447054
push 0x4880d0
push 0x486708
call fcn.004159fc
add esp, 8
test eax, eax
je 0x447054
push 0x486708
call fcn.00445bd0
add esp, 4
call fcn.004448d0
mov word [ebp - 0x664], 0
push 0x206
push 0
lea ecx, [ebp - 0x662]
push ecx
call fcn.00415680
add esp, 0xc
lea ecx, [ebp - 0x458]
call fcn.00402490
push eax
lea ecx, [ebp - 0x458]
call fcn.00401220
push eax
lea edx, [ebp - 0x664]
push edx
call fcn.00414cf4
add esp, 0xc
lea ecx, [ebp - 0x458]
call fcn.00402490
sub eax, 1
mov dword [ebp - 0x668], eax
jmp 0x4470c4
mov eax, dword [ebp - 0x668]
sub eax, 1
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x668], 0
jl 0x4470f4
mov ecx, dword [ebp - 0x668]
movzx edx, word [ebp + ecx*2 - 0x664]
cmp edx, 0x5c
jne 0x4470f2
mov eax, dword [ebp - 0x668]
mov word [ebp + eax*2 - 0x664], 0
jmp 0x4470f4
jmp 0x4470b5
lea ecx, [ebp - 0x664]
push ecx
call fcn.00437cb0
add esp, 4
mov word [ebp - 0x43c], 0
xor edx, edx
mov dword [ebp - 0x43a], edx
mov dword [ebp - 0x436], edx
mov dword [ebp - 0x432], edx
mov dword [ebp - 0x42e], edx
mov word [ebp - 0x42a], dx
lea ecx, [ebp - 0x458]
call fcn.00401220
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x447173
lea ecx, [ebp - 0x458]
call fcn.00401220
push eax
push 0xa
lea eax, [ebp - 0x43c]
push eax
push 0x475a60
lea ecx, [ebp - 0x190]
push ecx
lea edx, [ebp - 0x1a8]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x44717c
mov word [ebp - 0x43c], 0x32
mov word [ebp - 0x13c], 0
push 0xc6
push 0
lea eax, [ebp - 0x13a]
push eax
call fcn.00415680
add esp, 0xc
lea ecx, [ebp - 0x458]
call fcn.00401220
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4471e1
lea ecx, [ebp - 0x458]
call fcn.00401220
push eax
push 0x64
lea ecx, [ebp - 0x13c]
push ecx
push 0x475a64
lea edx, [ebp - 0x1e0]
push edx
lea eax, [ebp - 0x1a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x447234
push 0x48a1c8
call fcn.00414d31
add esp, 4
test eax, eax
jbe 0x447214
push 0x48a1c8
push 0x475a68
push 0xc8
push 0x64
lea ecx, [ebp - 0x13c]
push ecx
call fcn.004157ac
add esp, 0x14
jmp 0x447234
push 0x4888f0
push 0x475a70
push 0xc8
push 0x64
lea edx, [ebp - 0x13c]
push edx
call fcn.004157ac
add esp, 0x14
mov word [ebp - 0x3ec], 0
push 0x206
push 0
lea eax, [ebp - 0x3ea]
push eax
call fcn.00415680
add esp, 0xc
push 0x48a1c8
call fcn.00414d31
add esp, 4
test eax, eax
jne 0x44735b
push 0x4888f0
call fcn.00414d31
add esp, 4
test eax, eax
jne 0x44735b
push 0x475a78
push 0x486b18
call fcn.004159fc
add esp, 8
test eax, eax
je 0x4472bb
push 0x486b18
push 0x475a7c
push 0x208
push 0x104
lea ecx, [ebp - 0x3ec]
push ecx
call fcn.004157ac
add esp, 0x14
jmp 0x44735b
mov dword [ebp - 0x670], 0x104
lea edx, [ebp - 0x674]
push edx
push 0x20019
push 0
push 0x475a84
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x678], eax
lea eax, [ebp - 0x670]
push eax
lea ecx, [ebp - 0x3ec]
push ecx
push 0
push 0
push 0x475aa8
mov edx, dword [ebp - 0x674]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x674]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x66c]
push ecx
push 0xf003f
push 0
push 0x475abc
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44735b
push 0x475ae0
mov edx, dword [ebp - 0x66c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x66c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4884e0
call fcn.00414d31
add esp, 4
test eax, eax
jbe 0x4473b0
push 0x4882d8
push 0x4884e0
call fcn.004159fc
add esp, 8
test eax, eax
je 0x4473b0
mov dword [ebp - 0x140], 1
lea ecx, [ebp - 0x458]
call fcn.00401220
push eax
push 0x475af4
lea ecx, [ebp - 0x428]
push ecx
lea edx, [ebp - 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x4473dc
mov dword [ebp - 0x140], 0
lea ecx, [ebp - 0x458]
call fcn.00401220
push eax
push 0x475af8
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x458]
call fcn.00401220
push eax
lea edx, [ebp - 0x13c]
push edx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x458]
call fcn.00401220
push eax
lea edx, [ebp - 0x43c]
push edx
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x458]
call fcn.00401220
push eax
push 0x4884e0
lea edx, [ebp - 0x1c8]
push edx
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x458]
call fcn.00401220
push eax
lea ecx, [ebp - 0x3ec]
push ecx
lea edx, [ebp - 0x410]
push edx
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0xa
lea ecx, [ebp - 0x68c]
push ecx
mov edx, dword [0x48a804]
push edx
call fcn.004167b4
add esp, 0xc
lea ecx, [ebp - 0x458]
call fcn.00401220
push eax
lea eax, [ebp - 0x68c]
push eax
lea ecx, [ebp - 0x190]
push ecx
lea edx, [ebp - 0x1a8]
push edx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x458]
call fcn.00401220
push eax
push 0x4882d8
lea eax, [ebp - 0x164]
push eax
lea ecx, [ebp - 0x1a8]
push ecx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x458]
call fcn.00401220
push eax
push 0x489bb0
lea edx, [ebp - 0x1e0]
push edx
lea eax, [ebp - 0x1a8]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp dword [ebp - 0x140], 0
je 0x44770d
mov word [ebp - 0x894], 0
push 0x206
push 0
lea ecx, [ebp - 0x892]
push ecx
call fcn.00415680
add esp, 0xc
mov word [ebp - 0xca4], 0
push 0x206
push 0
lea edx, [ebp - 0xca2]
push edx
call fcn.00415680
add esp, 0xc
mov word [ebp - 0xa9c], 0
push 0x206
push 0
lea eax, [ebp - 0xa9a]
push eax
call fcn.00415680
add esp, 0xc
push 0x4880d0
call fcn.00414d31
add esp, 4
movzx ecx, word [eax*2 + 0x4880ce]
cmp ecx, 0x5c
jne 0x447596
push 0x4880d0
push 0x475afc
push 0x208
push 0x104
lea edx, [ebp - 0xca4]
push edx
call fcn.004157ac
add esp, 0x14
jmp 0x4475b9
push 0x4880d0
push 0x475b0c
push 0x208
push 0x104
lea eax, [ebp - 0xca4]
push eax
call fcn.004157ac
add esp, 0x14
cmp dword [0x48a7f8], 0
je 0x44764d
cmp dword [0x485c34], 1
jne 0x44761e
push 0x475b1c
lea ecx, [ebp - 0xca4]
push ecx
push 0x475b3c
push 0x208
push 0x104
lea edx, [ebp - 0x894]
push edx
call fcn.004157ac
add esp, 0x18
push str._fromQQ__startIM
push 0x475b6c
push 0x208
push 0x104
lea eax, [ebp - 0xa9c]
push eax
call fcn.004157ac
add esp, 0x14
jmp 0x447648
push str.StorageTool.exe__fromQQ__startIM
lea ecx, [ebp - 0xca4]
push ecx
push 0x475bbc
push 0x208
push 0x104
lea edx, [ebp - 0x894]
push edx
call fcn.004157ac
add esp, 0x18
jmp 0x4476cf
cmp dword [0x485c34], 1
jne 0x4476a5
push str.StorageTool.exe
lea eax, [ebp - 0xca4]
push eax
push 0x475be8
push 0x208
push 0x104
lea ecx, [ebp - 0x894]
push ecx
call fcn.004157ac
add esp, 0x18
push str._fromQQ
push 0x475c04
push 0x208
push 0x104
lea edx, [ebp - 0xa9c]
push edx
call fcn.004157ac
add esp, 0x14
jmp 0x4476cf
push 0x475c0c
lea eax, [ebp - 0xca4]
push eax
push 0x475c3c
push 0x208
push 0x104
lea ecx, [ebp - 0x894]
push ecx
call fcn.004157ac
add esp, 0x18
cmp dword [0x485c34], 1
jne 0x4476f1
lea edx, [ebp - 0xa9c]
push edx
lea eax, [ebp - 0x894]
push eax
call dword [sym.imp.QQVistaHelper.dll_void___cdecl_RunAsUser_wchar_t___wchar_t__]
add esp, 8
jmp 0x44770b
push 0
lea ecx, [ebp - 0xca4]
push ecx
lea edx, [ebp - 0x894]
push edx
push 0
call fcn.0043a810
add esp, 0x10
jmp 0x44771b
cmp dword [0x48a7f8], 0
je 0x44771b
call fcn.00444c50
mov dword [ebp - 0xca8], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x458]
call fcn.00401200
mov eax, dword [ebp - 0xca8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret