Function at 0x410b40
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4735f4
mov eax, dword fs:[0]
push eax
sub esp, 0x1c4
mov eax, dword [0x498068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
push 1
push str.SOFTWARETencentQQ2009
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 2
call fcn.004240f0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x410caf
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x104], esp
push 5
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], 0xf
push str.false
mov byte [ecx], bl
call fcn.00405f80
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x108], esp
push 0xc
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], 0xf
push str.NeedUnistall
mov byte [ecx], bl
call fcn.00405f80
mov byte [ebp - 4], 4
mov byte [ebp - 4], 2
call fcn.004410f0
add esp, 0x30
cmp dword [0x49ad2c], ebx
jg 0x410c8f
sub esp, 8
mov dword [ebp - 0x1d0], ebx
lea ecx, [ebp - 0x1c8]
call fcn.00422bb0
mov dword [ebp - 0x12c], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
mov dword [ebp - 0x128], 0x23
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x23
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
lea ecx, [ebp - 0x1d0]
mov dword [ebp - 0x124], eax
call fcn.00425610
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c8]
mov ebx, 1
mov edx, str.HKEY_LOCAL_MACHINSOFTWARETencentQQ2009_open_fail
mov dword [ebp - 0x10c], ebx
call fcn.00407130
mov dword [ebp - 4], 2
test bl, 1
je 0x411b62
lea ecx, [ebp - 0x1d0]
call fcn.00425110
jmp 0x411b62
lea eax, [ebp - 0x58]
push eax
push str.Install
lea ecx, [ebp - 0x118]
call fcn.00424470
test eax, eax
je 0x410dc1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x108], esp
push 5
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.false
mov byte [ecx], 0
call fcn.00405f80
sub esp, 0x18
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.NeedUnistall
mov byte [ecx], 0
call fcn.00405f80
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 2
call fcn.004410f0
add esp, 0x30
cmp dword [0x49ad2c], 0
jg 0x410da1
sub esp, 8
mov dword [ebp - 0x1d0], 0
lea ecx, [ebp - 0x1c8]
call fcn.00422bb0
mov dword [ebp - 0x12c], str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
mov dword [ebp - 0x128], 0x2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x2a
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
lea ecx, [ebp - 0x1d0]
mov dword [ebp - 0x124], eax
call fcn.00425610
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1c8]
mov ebx, 2
mov edx, str.HKEY_LOCAL_MACHINSOFTWARETencentQQ2009Install_read_fail
mov dword [ebp - 0x10c], ebx
call fcn.00407130
mov dword [ebp - 4], 2
test bl, 2
je 0x411b62
lea ecx, [ebp - 0x1d0]
call fcn.00425110
jmp 0x411b62
cmp dword [ebp - 0x48], 0
jne 0x410e88
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x108], esp
push 5
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.false
mov byte [ecx], 0
call fcn.00405f80
sub esp, 0x18
mov byte [ebp - 4], 0x11
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.NeedUnistall
mov byte [ecx], 0
call fcn.00405f80
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 2
call fcn.004410f0
add esp, 0x30
cmp dword [0x49ad2c], 0
jg 0x410e68
push 0
push 0x30
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
lea ecx, [ebp - 0x1d0]
call fcn.00424f80
mov byte [ebp - 4], 0x13
lea ecx, [eax + 8]
mov ebx, 4
mov edx, str.install_path_empty
mov dword [ebp - 0x10c], ebx
call fcn.00407130
mov dword [ebp - 4], 2
test bl, 4
je 0x411b62
lea ecx, [ebp - 0x1d0]
call fcn.00425110
jmp 0x411b62
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xd0]
call fcn.00401920
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x18
call fcn.00401810
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call esi
cmp eax, 0xffffffff
jne 0x410f75
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x108], esp
push 5
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.false
mov byte [ecx], 0
call fcn.00405f80
sub esp, 0x18
mov byte [ebp - 4], 0x19
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.NeedUnistall
mov byte [ecx], 0
call fcn.00405f80
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], 0x18
call fcn.004410f0
add esp, 0x30
cmp dword [0x49ad2c], 0
jg 0x410f55
push 0
push 0x37
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
lea ecx, [ebp - 0x1d0]
call fcn.00424f80
mov byte [ebp - 4], 0x1b
lea ecx, [eax + 8]
mov ebx, 8
mov edx, str.install_path_not_exists
mov dword [ebp - 0x10c], ebx
call fcn.00407130
mov dword [ebp - 4], 0x18
test bl, 8
je 0x411b53
lea ecx, [ebp - 0x1d0]
call fcn.00425110
jmp 0x411b53
push str.Uninstall.xml
lea ecx, [ebp - 0x28]
call fcn.004018b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x20
push eax
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0xd0]
call fcn.00426760
mov ecx, eax
mov byte [ebp - 4], 0x21
call fcn.00401810
push eax
call esi
cmp eax, 0xffffffff
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xa0]
sete byte [ebp - 0x10d]
call fcn.00401850
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x411001
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410ff7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411c0b
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 0x18
cmp byte [ebp - 0x10d], al
je 0x411506
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x108], esp
push 5
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
push str.false
mov byte [ecx], al
call fcn.00405f80
sub esp, 0x18
mov byte [ebp - 4], 0x26
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.NeedUnistall
mov byte [ecx], 0
call fcn.00405f80
mov byte [ebp - 4], 0x27
mov byte [ebp - 4], 0x18
call fcn.004410f0
add esp, 0x30
cmp dword [0x49ad2c], 0
jg 0x4110bd
push 0
push 0x3d
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
lea ecx, [ebp - 0x1d0]
call fcn.00424f80
mov byte [ebp - 4], 0x28
lea ecx, [eax + 8]
mov ebx, 0x10
mov edx, str.Uninstall.xml_path_not_exists
mov dword [ebp - 0x10c], ebx
call fcn.00407130
mov dword [ebp - 4], 0x18
test bl, 0x10
je 0x4110dd
and ebx, 0xffffffef
lea ecx, [ebp - 0x1d0]
mov dword [ebp - 0x10c], ebx
call fcn.00425110
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
push 0x20019
push str.SoftwareTencentQQ2009
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x29
call fcn.004240f0
test eax, eax
jne 0x411629
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x2f
push eax
push str.version
lea ecx, [ebp - 0x120]
call fcn.00424470
test eax, eax
jne 0x4113cc
cmp dword [ebp - 0x30], eax
je 0x4113cc
mov byte [ebp - 4], 0x38
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
sub esp, 0x18
mov byte [ebp - 4], 0x39
mov ecx, esp
mov dword [ebp - 0x108], esp
push 0xd
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
push 0x485034
mov byte [ecx], al
call fcn.00405f80
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x39
call fcn.00441670
add esp, 0x18
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0xa0]
push eax
call fcn.00401920
push str.Uninstall.xml
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x3b
call fcn.004018b0
push str.Uninstall
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x3c
call fcn.004018b0
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x3d
push eax
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0xa0]
call fcn.00426760
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x3e
push ecx
lea ecx, [ebp - 0xe8]
push ecx
mov ecx, eax
call fcn.00426760
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x3f
push ecx
lea ecx, [ebp - 0xb8]
push ecx
mov ecx, eax
call fcn.00426760
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0x41
call fcn.00401850
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0x42
call fcn.00401850
mov byte [ebp - 4], 0x44
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x411283
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411279
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411c10
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
mov byte [ebp - 4], 0x49
mov edx, dword [ebp - 0x74]
cmp edx, 8
jb 0x4112d8
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4112ce
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411c15
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x48
call fcn.00401810
push eax
call esi
cmp eax, 0xffffffff
jne 0x41140d
cmp dword [0x49ad2c], 0
jg 0x411341
push 0
push 0x52
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
lea ecx, [ebp - 0x1d0]
call fcn.00424f80
or ebx, 0x20
mov byte [ebp - 4], 0x4d
lea ecx, [eax + 8]
mov dword [ebp - 0x10c], ebx
mov edx, str.Uninstall.xml_backup_path_not_exists
call fcn.00407130
mov dword [ebp - 4], 0x48
test bl, 0x20
je 0x411358
lea ecx, [ebp - 0x1d0]
call fcn.00425110
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x3b
call fcn.00401850
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x39
call fcn.00401850
mov byte [ebp - 4], 0x4e
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4113b4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4113aa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411c1a
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 0x2f
mov byte [ebp - 4], 0x52
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x411611
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411607
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411c1f
jmp 0x411607
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x3b
call fcn.00401850
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x39
call fcn.00401850
mov byte [ebp - 4], 0x5a
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x411469
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41145f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411c24
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 0x5e
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x4114bb
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4114b1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411c29
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x11c]
test eax, eax
je 0x4114ef
push eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
mov dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x120]
test eax, eax
je 0x411506
push eax
call edi
mov dword [ebp - 0x120], 0
mov byte [ebp - 4], 0x62
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x63
push eax
push str.version
lea ecx, [ebp - 0x118]
call fcn.00424470
sub esp, 0x18
mov dword [ebp - 0x108], esp
mov ecx, esp
test eax, eax
je 0x411669
push 5
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.false
mov byte [ecx], 0
call fcn.00405f80
sub esp, 0x18
mov byte [ebp - 4], 0x64
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.NeedUnistall
mov byte [ecx], 0
call fcn.00405f80
mov byte [ebp - 4], 0x65
mov byte [ebp - 4], 0x63
call fcn.004410f0
add esp, 0x30
cmp dword [0x49ad2c], 0
jg 0x4115e7
push 0
push 0x5b
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
lea ecx, [ebp - 0x1d0]
call fcn.00424f80
or ebx, 0x40
mov byte [ebp - 4], 0x66
lea ecx, [eax + 8]
mov dword [ebp - 0x10c], ebx
mov edx, str.HKEY_LOCAL_MACHINSOFTWARETencentQQ2009_version_read_fail
call fcn.00407130
mov dword [ebp - 4], 0x63
test bl, 0x40
je 0x411b47
lea ecx, [ebp - 0x1d0]
call fcn.00425110
jmp 0x411b47
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 0x29
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x11c]
test eax, eax
je 0x411649
push eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
mov dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x120]
test eax, eax
je 0x411b53
push eax
call edi
mov dword [ebp - 0x120], 0
jmp 0x411b53
cmp dword [ebp - 0x30], 0
jne 0x411725
push 5
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.false
mov byte [ecx], 0
call fcn.00405f80
sub esp, 0x18
mov byte [ebp - 4], 0x6f
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.NeedUnistall
mov byte [ecx], 0
call fcn.00405f80
mov byte [ebp - 4], 0x70
mov byte [ebp - 4], 0x63
call fcn.004410f0
add esp, 0x30
cmp dword [0x49ad2c], 0
jg 0x411706
push 0
push 0x61
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
lea ecx, [ebp - 0x1d0]
call fcn.00424f80
or ebx, 0x80
mov byte [ebp - 4], 0x71
lea ecx, [eax + 8]
mov dword [ebp - 0x10c], ebx
mov edx, str.version_empty
call fcn.00407130
mov dword [ebp - 4], 0x63
test bl, bl
jns 0x411b47
lea ecx, [ebp - 0x1d0]
call fcn.00425110
jmp 0x411b47
lea eax, [ebp - 0x40]
push eax
call fcn.00401920
sub esp, 0x18
mov byte [ebp - 4], 0x7a
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0xf
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.PreviousVersion
mov byte [ecx], 0
call fcn.00405f80
mov byte [ebp - 4], 0x7b
mov byte [ebp - 4], 0x63
call fcn.00441450
add esp, 0x30
mov byte [ebp - 4], 0x7c
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x7d
push eax
push str.rversion
lea ecx, [ebp - 0x118]
call fcn.00424470
sub esp, 0x18
mov dword [ebp - 0x108], esp
mov ecx, esp
test eax, eax
jne 0x4117f2
lea eax, [ebp - 0x28]
push eax
call fcn.00401920
sub esp, 0x18
mov byte [ebp - 4], 0x7e
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0x16
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x484fc8
mov byte [ecx], 0
call fcn.00405f80
mov byte [ebp - 4], 0x7f
jmp 0x41182b
lea eax, [ebp - 0x40]
push eax
call fcn.00401920
sub esp, 0x18
mov byte [ebp - 4], 0x80
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0x16
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x484fc8
mov byte [ecx], 0
call fcn.00405f80
mov byte [ebp - 4], 0x81
mov byte [ebp - 4], 0x7d
call fcn.00441450
add esp, 0x30
mov byte [ebp - 4], 0x82
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x411875
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41186b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411c2e
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 0x63
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x104]
push eax
push ecx
lea ecx, [ebp - 0x118]
call fcn.00424360
test eax, eax
je 0x41196f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x108], esp
push 5
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.false
mov byte [ecx], 0
call fcn.00405f80
sub esp, 0x18
mov byte [ebp - 4], 0x86
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.NeedUnistall
mov byte [ecx], 0
call fcn.00405f80
mov byte [ebp - 4], 0x87
mov byte [ebp - 4], 0x63
call fcn.004410f0
add esp, 0x30
cmp dword [0x49ad2c], 0
jg 0x41194c
push 0
push 0x73
push str.d:devopsworkspacep_37d34ce895ed4865ac95061b653d796fmisc_setup3uninstallcustomaction_taskget_uninstall_environment.cpp
lea ecx, [ebp - 0x1d0]
call fcn.00424f80
or ebx, 0x100
mov byte [ebp - 4], 0x88
lea ecx, [eax + 8]
mov dword [ebp - 0x10c], ebx
mov edx, str.HKEY_LOCAL_MACHINSOFTWARETencentQQ2009_read_fail
call fcn.00407130
mov dword [ebp - 4], 0x63
test ebx, 0x100
je 0x411b47
lea ecx, [ebp - 0x1d0]
call fcn.00425110
jmp 0x411b47
cmp dword [ebp - 0x104], 1
jne 0x411a8e
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x108], esp
push 8
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x484ff0
mov byte [ecx], 0
call fcn.00405f80
sub esp, 0x18
mov byte [ebp - 4], 0x89
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0x13
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x485020
mov byte [ecx], 0
call fcn.00405f80
mov byte [ebp - 4], 0x8a
mov byte [ebp - 4], 0x63
call fcn.004410f0
add esp, 0x18
lea eax, [ebp - 0x58]
mov ecx, esp
mov dword [ebp - 0x108], esp
push eax
call fcn.00401920
sub esp, 0x18
mov byte [ebp - 4], 0x8b
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0x13
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x484ffc
mov byte [ecx], 0
call fcn.00405f80
mov byte [ebp - 4], 0x8c
mov byte [ebp - 4], 0x63
call fcn.00441450
add esp, 0x18
mov ecx, esp
mov dword [ebp - 0x108], esp
push 4
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.true
mov byte [ecx], 0
call fcn.00405f80
sub esp, 0x18
mov byte [ebp - 4], 0x8d
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.NeedUnistall
mov byte [ecx], 0
call fcn.00405f80
mov byte [ebp - 4], 0x8e
mov byte [ebp - 4], 0x63
call fcn.004410f0
add esp, 0x30
mov byte [ebp - 4], 0x8f
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push 1
push str.SOFTWARETencentTIM
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x90
call fcn.004240f0
test eax, eax
jne 0x411b3b
lea eax, [ebp - 0x28]
push eax
push str.Install
lea ecx, [ebp - 0x118]
call fcn.00424470
test eax, eax
jne 0x411b3b
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
mov dword [ebp - 0x108], esp
push eax
call fcn.00401920
sub esp, 0x18
mov byte [ebp - 4], 0x91
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0xe
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.TIMInstallPath
mov byte [ecx], 0
call fcn.00405f80
mov byte [ebp - 4], 0x92
mov byte [ebp - 4], 0x90
call fcn.00441450
add esp, 0x30
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x63
call fcn.00401850
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x18
call fcn.00401850
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 2
call fcn.00401850
mov byte [ebp - 4], 0x93
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x411ba0
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411b96
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411c33
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x411bd6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x118]
test eax, eax
je 0x411bed
push eax
call edi
mov dword [ebp - 0x118], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f786
mov esp, ebp
pop ebp
ret 4
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
call fcn.00454bbf
int3