Function at 0x4c0cb0
Capabilities:
Check if file exists
Copy file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5141fd
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x550144]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004c2450
lea ecx, [ebp - 0x2c]
call fcn.00479c60
push 0
push 0
push str..qbox
push SysReAllocString
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00479c90
test eax, eax
je 0x4c0d1d
push str.QQPCMgr.qbox
push 0x53637c
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push 0
push 0
push str.QQPCMgr.qbox
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c90
test eax, eax
je 0x4c0d49
push 0x51de68
push 0x53637c
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push 0
push 0
push str.QQPCMgr.qboxDefaultIcon
push SysReAllocString
lea ecx, [ebp - 0x2c]
lea edi, [esi + 4]
call fcn.00479c90
test eax, eax
je 0x4c0d95
push str.imageqbox.ico_0
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0048c0d0
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
push 0x53637c
lea ecx, [ebp - 0x2c]
call fcn.00492da0
lea ecx, [ebp - 0x30]
call fcn.0044c080
push 0
push 0
push str.QQPCMgr.qbox_shell
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c90
test eax, eax
je 0x4c0dc1
push 0x53637c
push 0x53637c
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push 0
push 0
push str.QQPCMgr.qbox_shellopen
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c90
test eax, eax
je 0x4c0ded
push 0x51df38
push 0x53637c
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push 0
push 0
push str.QQPCMgr.qbox_shellcommand
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c90
test eax, eax
je 0x4c0e36
push str.QQPCFileSafe.exe___1_
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0048c0d0
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
push 0x53637c
lea ecx, [ebp - 0x2c]
call fcn.00492da0
lea ecx, [ebp - 0x30]
call fcn.0044c080
push 0
push 0
push str.QMRemote
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c90
test eax, eax
je 0x4c0eb0
push 0x538734
push 0x53637c
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push edi
lea eax, [ebp - 0x38]
push 0x538378
push eax
call fcn.0048cb80
push str.QMRemote.exe_
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 1
push eax
call fcn.0048c0d0
add esp, 0x18
mov ecx, eax
call fcn.0044c0a0
push eax
push str.URL_Protocol
lea ecx, [ebp - 0x2c]
call fcn.00492da0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.0044c080
push 0
push 0
push str.QMRemoteShell
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c90
test eax, eax
je 0x4c0edc
push 0x53637c
push 0x53637c
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push 0
push 0
push str.QMRemoteShellOpen
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c90
test eax, eax
je 0x4c0f08
push 0x53637c
push 0x53637c
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push 0
push 0
push str.QMRemoteShellOpenCommand
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c90
test eax, eax
je 0x4c0f70
push edi
lea eax, [ebp - 0x38]
push 0x538378
push eax
call fcn.0048cb80
push str.QQPCMgr.exe___pullRemote___1_
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.0048c0d0
add esp, 0x18
mov ecx, eax
call fcn.0044c0a0
push eax
push 0x53637c
lea ecx, [ebp - 0x2c]
call fcn.00492da0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.0044c080
cmp dword [esi + 0x14], 0
jne 0x4c11ee
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c90
test eax, eax
je 0x4c1074
push 0x538378
lea ecx, [ebp - 0x34]
call fcn.0044f140
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x34]
call fcn.0048c600
push str.QQPCTray.exe_
lea ecx, [ebp - 0x34]
call fcn.0048c600
lea ecx, [ebp - 0x34]
call fcn.0044c0a0
push eax
push str.DisplayIcon
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push 0x53826c
push 0x51ba34
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push 0x538378
lea ecx, [ebp - 0x34]
call fcn.0044f4c0
mov ecx, edi
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x34]
call fcn.0048c600
push str.Uninst.exe_
lea ecx, [ebp - 0x34]
call fcn.0048c600
lea ecx, [ebp - 0x34]
call fcn.0044c0a0
push eax
push str.UninstallString
lea ecx, [ebp - 0x2c]
call fcn.00492da0
lea ecx, [esi + 0xc]
call fcn.0044c0a0
push eax
push 0x51e19c
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push str.https:__guanjia.qq.com_
push str.URLInfoAbout
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push 0x51e208
push str.Publisher
lea ecx, [ebp - 0x2c]
call fcn.00492da0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.0044c080
cmp dword [esi + 0x14], 0
jne 0x4c11ee
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.004c2de0
test eax, eax
je 0x4c11ee
push edi
lea ecx, [ebp - 0x30]
call fcn.0048d110
push str.QQPCTray.exe
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.0048c600
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x30]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push edi
lea ecx, [ebp - 0x38]
call fcn.0048d110
push str.QQPCExternal.exe
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 5
call fcn.0048c600
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x38]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push edi
lea ecx, [ebp - 0x3c]
call fcn.0048d110
push str.QQPCSoftMgr.exe
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 6
call fcn.0048c600
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x3c]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push edi
lea ecx, [ebp - 0x44]
call fcn.0048d110
push str.QMSecurityLab.exe
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 7
call fcn.0048c600
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x44]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push edi
lea ecx, [ebp - 0x40]
call fcn.0048d110
push str.QMLspPing.exe
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 8
call fcn.0048c600
push str._PERPROCESSSYSTEMDPIFORCEON_HIGHDPIAWARE
lea ecx, [ebp - 0x40]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push edi
lea ecx, [ebp - 0x34]
call fcn.0048d110
push str.NetworkMon.exe
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 9
call fcn.0048c600
push str._PERPROCESSSYSTEMDPIFORCEOFF
lea ecx, [ebp - 0x34]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00492da0
lea ecx, [ebp - 0x34]
call fcn.0044c080
lea ecx, [ebp - 0x40]
call fcn.0044c080
lea ecx, [ebp - 0x44]
call fcn.0044c080
lea ecx, [ebp - 0x3c]
call fcn.0044c080
lea ecx, [ebp - 0x38]
call fcn.0044c080
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.0044c080
push 0
push 0
push str.SYSTEMCurrentControlSet_servicesQQPCRTP
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c90
test eax, eax
je 0x4c1217
push 0
push str.RtpFlag
lea ecx, [ebp - 0x2c]
call fcn.00492d70
push 0
push 0
push str.SOFTWARETencent
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c90
test eax, eax
je 0x4c1243
push 0x519090
push str.QQPCFlag
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push 0
push 0
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c90
test eax, eax
je 0x4c136b
mov ecx, edi
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x28]
call fcn.0048d040
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xa
push eax
call fcn.00487470
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.0044a640
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492da0
mov ebx, eax
push ebx
push str.WriteReg_InstallDir__Result_:__d
push 0x550bb8
call fcn.0048d5c0
add esp, 0xc
cmp dword [esi + 0x20], 0
je 0x4c12bd
test ebx, ebx
je 0x4c12bd
mov eax, 1
jmp 0x4c12bf
xor eax, eax
lea ecx, [esi + 0xc]
mov dword [esi + 0x20], eax
call fcn.0044c0a0
push eax
push str.Version
lea ecx, [ebp - 0x2c]
call fcn.00492da0
mov ebx, eax
push ebx
push str.WriteReg_Version__Result_:__d
push 0x550bb8
call fcn.0048d5c0
add esp, 0xc
cmp dword [esi + 0x20], 0
je 0x4c12fe
test ebx, ebx
je 0x4c12fe
mov eax, 1
jmp 0x4c1300
xor eax, eax
push str.QQPCMgr.exe
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0048c0d0
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
push str.ExeString
lea ecx, [ebp - 0x2c]
call fcn.00492da0
lea ecx, [ebp - 0x30]
call fcn.0044c080
push 1
push str.IdleScanTip
lea ecx, [ebp - 0x2c]
call fcn.00492d70
push 0
push str.FirstRun
lea ecx, [ebp - 0x2c]
call fcn.00492d70
push 1
push str.IsTrayCrashed
lea ecx, [ebp - 0x2c]
call fcn.00492d70
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a650
push 0
push 0
push str.SOFTWARETencentQQPCMgrVulFW
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c90
test eax, eax
je 0x4c1394
push 1
push str.bCameraProtection
lea ecx, [ebp - 0x2c]
call fcn.00492d70
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c90
test eax, eax
je 0x4c13c8
push str.QMTray
lea ecx, [ebp - 0x2c]
call fcn.00492df0
push 0x51e524
lea ecx, [ebp - 0x2c]
call fcn.00492df0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunQQDisabled
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c90
test eax, eax
je 0x4c13fc
push 0x51e524
lea ecx, [ebp - 0x2c]
call fcn.00492df0
push str._QQPCTray
lea ecx, [ebp - 0x2c]
call fcn.00492df0
push 0
push 0
push str.QMConfigQQDoctorQQDoctorComCfg
push reloc.WS2_32.dll_closesocket
lea ecx, [ebp - 0x2c]
call fcn.00479c90
test eax, eax
je 0x4c1423
push str.defCoveredRemoteSetting
lea ecx, [ebp - 0x2c]
call fcn.00492df0
mov ecx, esi
call fcn.004c1cb0
call fcn.00487920
test eax, eax
jne 0x4c1483
push str.Set_TSKSP_autostart
push 0x550bb8
call fcn.0048d5c0
add esp, 8
lea ecx, [ebp - 0x2c]
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTSKSP
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00479c90
test eax, eax
je 0x4c1471
push 0x519090
push str.autostart
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push str.Set_TSKSP_autostart_end
push 0x550bb8
call fcn.0048d5c0
add esp, 8
push str.Set_QQSoftMgr_reg
push 0x550bb8
call fcn.0048d5c0
add esp, 8
lea ecx, [ebp - 0x2c]
push 0
push 0
push str.SOFTWARETENCENTDeskUpdateQQSoftMgr
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00479c90
lea edi, [esi + 4]
test eax, eax
je 0x4c156d
push str.QQPCSoftMgr.exe
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0048c0d0
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
push str.ExeString
lea ecx, [ebp - 0x2c]
call fcn.00492da0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x34]
call fcn.0047d240
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0xb
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00479df0
test eax, eax
je 0x4c1561
lea ecx, [ebp - 0x34]
call fcn.0048d3f0
test al, al
jne 0x4c1561
lea ecx, [ebp - 0x34]
call fcn.0044f760
test eax, eax
je 0x4c1561
push ecx
mov ecx, esp
push edi
call fcn.0048d110
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.004c2200
mov ecx, eax
call fcn.0044c0a0
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492da0
lea ecx, [ebp - 0x30]
call fcn.0044c080
push str.0.500
push str.Version
lea ecx, [ebp - 0x2c]
call fcn.00492da0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.0044c080
push str.Set_TsFltMgr_reg
push 0x550bb8
call fcn.0048d5c0
add esp, 8
call fcn.00487920
test eax, eax
jne 0x4c1b23
push eax
push eax
push str.SYSTEMCurrentControlSetServicesTsFltMgr
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c90
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c1709
push str.DeleteFlag
lea ecx, [ebp - 0x2c]
call fcn.00492df0
lea eax, [ebp - 0x28]
push eax
call fcn.004890f0
add esp, 4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xc
call fcn.0048f1e0
lea ecx, [ebp - 0x28]
call fcn.0044a640
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push str.TsFltMgr.sys
lea ecx, [ebp - 0x34]
call fcn.0044f140
mov byte [ebp - 4], 0xd
call fcn.004873d0
test eax, eax
je 0x4c1610
push str.TsFltMgr_ev.sys
lea ecx, [ebp - 0x34]
call fcn.0044f4c0
lea ecx, [ebp - 0x34]
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x28]
call fcn.0048f560
lea eax, [ebp - 0x34]
push eax
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00497170
add esp, 0xc
lea ecx, [ebp - 0x28]
mov esi, eax
push 0
call fcn.0044a640
push eax
mov ecx, esi
call fcn.0044c0a0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x28]
call fcn.0044a640
push eax
call ebx
test eax, eax
je 0x4c16da
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push str.System32drivers_
push eax
call fcn.0048cb80
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
push str.ImagePath
lea ecx, [ebp - 0x2c]
call fcn.00492da0
lea ecx, [ebp - 0x30]
call fcn.0044c080
push 0
push str.ErrorControl
lea ecx, [ebp - 0x2c]
call fcn.00492d70
push 0
push str.Start
lea ecx, [ebp - 0x2c]
call fcn.00492d70
push 1
push str.Type
lea ecx, [ebp - 0x2c]
call fcn.00492d70
push str.TsFltMgr
push 0x51ba34
lea ecx, [ebp - 0x2c]
call fcn.00492da0
jmp 0x4c16f5
lea ecx, [ebp - 0x28]
call fcn.0044a640
push eax
push str.Not_Found__ws
push 0x550bb8
call fcn.0048d5c0
add esp, 0xc
lea ecx, [ebp - 0x34]
call fcn.0044c080
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a650
push str.WriteRegStr_TSKSP_..begin
push 0x550bb8
call fcn.0048d5c0
add esp, 8
lea ecx, [ebp - 0x2c]
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTSKSP
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00479c90
test eax, eax
je 0x4c187a
push str.DeleteFlag
lea ecx, [ebp - 0x2c]
call fcn.00492df0
mov ecx, edi
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x28]
call fcn.0048d040
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xe
call fcn.0048f1e0
lea ecx, [ebp - 0x28]
call fcn.0044a640
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push str.TSKsp.sys
lea ecx, [ebp - 0x34]
call fcn.0044f140
mov byte [ebp - 4], 0xf
call fcn.004873d0
test eax, eax
je 0x4c179f
push str.TSKsp_ev.sys
lea ecx, [ebp - 0x34]
call fcn.0044f4c0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.00497170
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
call ebx
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.0044c080
test esi, esi
je 0x4c1866
push edi
lea eax, [ebp - 0x38]
push 0x51b9f4
push eax
call fcn.0048cb80
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x10
push ecx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00497170
add esp, 0x18
mov ecx, eax
call fcn.0044c0a0
push eax
push str.ImagePath
lea ecx, [ebp - 0x2c]
call fcn.00492da0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x38]
call fcn.0044c080
push 0
push str.ErrorControl
lea ecx, [ebp - 0x2c]
call fcn.00492d70
push 1
push str.Start
lea ecx, [ebp - 0x2c]
call fcn.00492d70
push 1
push str.Type
lea ecx, [ebp - 0x2c]
call fcn.00492d70
push str.TSKSP
push 0x51ba34
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push 0x519090
push str.autostart
lea ecx, [ebp - 0x2c]
call fcn.00492da0
lea ecx, [ebp - 0x34]
call fcn.0044c080
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a650
push str.WriteRegStr_TSKSP_..end
push 0x550bb8
call fcn.0048d5c0
add esp, 8
lea ecx, [ebp - 0x2c]
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTSSysKit
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00479c90
test eax, eax
je 0x4c19c3
push str.DeleteFlag
lea ecx, [ebp - 0x2c]
call fcn.00492df0
mov ecx, edi
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x28]
call fcn.0048d040
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x11
call fcn.0048f1e0
lea ecx, [ebp - 0x28]
call fcn.0044a640
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push 0x51c000
lea ecx, [ebp - 0x34]
call fcn.0044f140
mov byte [ebp - 4], 0x12
call fcn.004873d0
test eax, eax
je 0x4c1910
push str.TSSysKit_ev.sys
lea ecx, [ebp - 0x34]
call fcn.0044f4c0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.00497170
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
call ebx
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.0044c080
test esi, esi
je 0x4c19af
push edi
lea eax, [ebp - 0x38]
push 0x51b9f4
push eax
call fcn.0048cb80
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x13
push ecx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00497170
add esp, 0x18
mov ecx, eax
call fcn.0044c0a0
push eax
push str.ImagePath
lea ecx, [ebp - 0x2c]
call fcn.00492da0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x38]
call fcn.0044c080
push 0
push str.ErrorControl
lea ecx, [ebp - 0x2c]
call fcn.00492d70
push 1
push str.Start
lea ecx, [ebp - 0x2c]
call fcn.00492d70
push 1
push str.Type
lea ecx, [ebp - 0x2c]
call fcn.00492d70
lea ecx, [ebp - 0x34]
call fcn.0044c080
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a650
push str.QMIEProtect.sys
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0048c0d0
add esp, 0xc
mov ecx, eax
call fcn.0044c0a0
push eax
call ebx
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.0044c080
test esi, esi
je 0x4c1b23
push 0
push 0
push str.SYSTEMCurrentControlSetServicesQMIEProtect
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c90
test eax, eax
je 0x4c1b23
push str.DeleteFlag
lea ecx, [ebp - 0x2c]
call fcn.00492df0
mov ecx, edi
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x28]
call fcn.0048d040
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x14
call fcn.0048f1e0
lea ecx, [ebp - 0x28]
call fcn.0044a640
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push str.QMIEProtect.sys
lea ecx, [ebp - 0x30]
call fcn.0044f140
mov byte [ebp - 4], 0x15
call fcn.004873d0
test eax, eax
je 0x4c1a75
push str.QMIEProtect_ev.sys
lea ecx, [ebp - 0x30]
call fcn.0044f4c0
push edi
lea eax, [ebp - 0x3c]
push 0x51b9f4
push eax
call fcn.0048cb80
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x16
push ecx
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00497170
add esp, 0x18
mov ecx, eax
call fcn.0044c0a0
push eax
push str.ImagePath
lea ecx, [ebp - 0x2c]
call fcn.00492da0
lea ecx, [ebp - 0x38]
call fcn.0044c080
lea ecx, [ebp - 0x3c]
call fcn.0044c080
push 0
push str.ErrorControl
lea ecx, [ebp - 0x2c]
call fcn.00492d70
push 2
push str.Start
lea ecx, [ebp - 0x2c]
call fcn.00492d70
push 1
push str.Type
lea ecx, [ebp - 0x2c]
call fcn.00492d70
push str.QMIEProtect
push 0x51ba34
lea ecx, [ebp - 0x2c]
call fcn.00492da0
push 0x519090
push str.autostart
lea ecx, [ebp - 0x2c]
call fcn.00492da0
lea ecx, [ebp - 0x30]
call fcn.0044c080
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a650
call fcn.00487920
test eax, eax
je 0x4c1b91
push 0
push 0
push str.SYSTEMCurrentControlSetServicesQQSysMonX64
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.00479c90
test eax, eax
je 0x4c1b91
push str.DeleteFlag
lea ecx, [ebp - 0x2c]
call fcn.00492df0
mov ecx, edi
call fcn.0044c0a0
push eax
lea ecx, [ebp - 0x28]
call fcn.0048d040
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
call fcn.0048f1e0
lea ecx, [ebp - 0x28]
call fcn.0044a640
push eax
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.00492da0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0044a650
mov ecx, 0x553028
call fcn.004b1630
test eax, eax
jne 0x4c1c3b
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x38], eax
call fcn.00479c60
push 0
push 1
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x18
call fcn.00479c90
test eax, eax
je 0x4c1c33
lea eax, [ebp - 0x38]
push eax
push str.SupplyID
lea ecx, [ebp - 0x30]
call fcn.00479da0
mov eax, dword [ebp - 0x38]
cmp eax, 0x7270e00
jb 0x4c1bee
cmp eax, 0x7bfa47f
jbe 0x4c1bfa
add eax, 0xfffe2b3f
cmp eax, 0x270e
ja 0x4c1c33
call fcn.00487920
lea ecx, [ebp - 0x2c]
push 0
push 0
test eax, eax
jne 0x4c1c11
push str.SYSTEMCurrentControlSetServicesQQSysMon
jmp 0x4c1c16
push str.SYSTEMCurrentControlSetServicesQQSysMonX64
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00479c90
test eax, eax
je 0x4c1c33
push 3
push str.spvalue
lea ecx, [ebp - 0x2c]
call fcn.00492d70
lea ecx, [ebp - 0x30]
call fcn.00479c70
lea ecx, [ebp - 0x2c]
call fcn.00479c70
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004de0fd
mov esp, ebp
pop ebp
ret