Function at 0x407030
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x4e5958
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50f130]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x44]
lea eax, [esp + 0x20]
push eax
call fcn.004061a0
xor edi, edi
mov dword [esp + 0x3c], edi
mov eax, dword [esp + 0x24]
cmp eax, edi
je 0x40708c
mov ecx, dword [esp + 0x28]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x4070c6
push str.677B9715_5692_49f6_979F_CD11EC963EFE
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, edi
je 0x407649
mov dword [0x5157fc], eax
push 0x4efe38
mov ecx, 0x5158b0
mov dword [ebp + 0x38], edi
call fcn.00489840
add esp, 4
mov dword [ebp + 4], 1
jmp 0x407649
mov edx, dword [0x5143cc]
mov eax, dword [edx + 0xc]
mov ecx, 0x5143cc
call eax
add eax, 0x10
mov dword [esp + 0x44], eax
lea ecx, [esp + 0x44]
push ecx
mov ebx, 1
push 0x4efe44
lea eax, [esp + 0x28]
mov byte [esp + 0x44], bl
call fcn.00406440
test eax, eax
je 0x407100
mov dword [ebp + 4], ebx
lea edx, [esp + 0x44]
push edx
push 0x4efe48
lea eax, [esp + 0x28]
call fcn.00406440
test eax, eax
je 0x40711a
mov dword [ebp + 4], ebx
lea eax, [esp + 0x44]
push eax
push str.showtips
lea eax, [esp + 0x28]
call fcn.00406440
test eax, eax
je 0x407134
mov dword [ebp + 8], ebx
lea ecx, [esp + 0x44]
push ecx
push str.filedestroy
lea eax, [esp + 0x28]
call fcn.00406440
test eax, eax
je 0x40714e
mov dword [ebp + 0xc], ebx
lea edx, [esp + 0x44]
push edx
push str.DbgExtract
lea eax, [esp + 0x28]
call fcn.00406440
test eax, eax
je 0x4071e2
lea eax, [ebp + 0x1c]
push eax
push str.DbgExtractpath
lea eax, [esp + 0x28]
call fcn.00406440
test eax, eax
jne 0x4071af
mov byte [esp + 0x3c], al
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40719f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ebx, [esp + 0x20]
call fcn.00408610
xor eax, eax
jmp 0x407657
lea ecx, [ebp + 0x20]
push ecx
push str.DbgExtractFiles
lea eax, [esp + 0x28]
call fcn.00406440
mov byte [esp + 0x3c], 0
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
mov dword [ebp + 0x18], ebx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x40763d
lea ecx, [esp + 0x44]
push ecx
push str.recommand
lea eax, [esp + 0x28]
call fcn.00406440
test eax, eax
je 0x40723f
mov esi, dword [esp + 0x44]
push esi
push str.supply_is__s
mov ecx, 0x5158b0
call fcn.00489840
push esi
call fcn.004b840e
mov ecx, 4
add esp, 0xc
test cl, al
jne 0x407221
xor ecx, ecx
test al, 8
jne 0x40722a
cmp ecx, 8
jne 0x407234
call fcn.004123f0
jmp 0x4072dc
mov dword [0x5156b4], ecx
jmp 0x4072dc
push edi
lea edx, [esp + 0x1c]
push edx
push edi
push 0xf003f
push edi
push edi
push edi
push str.SOFTWARETencentQQPCMgr
mov byte [esp + 0x5c], 2
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x4072c9
lea eax, [esp + 0x1c]
push eax
push str.ExtendQQNavigation
lea eax, [esp + 0x20]
call fcn.004098d0
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x407296
push str.ExtendQQNavigation
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0x1c]
cmp eax, 0xb
jne 0x4072ac
call fcn.004123f0
mov dword [0x5156b8], edi
jmp 0x4072c9
cmp eax, 0xc
jne 0x4072be
call fcn.004123f0
mov dword [0x5156b8], ebx
jmp 0x4072c9
cmp eax, 0xd
jne 0x4072c9
mov dword [0x5156bc], ebx
mov byte [esp + 0x3c], bl
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x4072dc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x44]
push ecx
push str.installpath
lea eax, [esp + 0x28]
call fcn.00406440
test eax, eax
je 0x407347
lea eax, [esp + 0x44]
call fcn.004214e0
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x1c]
push edx
call fcn.0040d4e0
lea edi, [esp + 0x44]
mov byte [esp + 0x3c], 3
call fcn.00401410
mov byte [esp + 0x3c], bl
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40733c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esp + 0x44]
call fcn.0040dff0
xor edi, edi
lea ecx, [esp + 0x44]
push ecx
push str.qqpcmgr
lea eax, [esp + 0x28]
call fcn.00406440
test eax, eax
je 0x40736e
mov edx, dword [esp + 0x44]
push edx
call fcn.004b840e
add esp, 4
mov dword [ebp + 0x38], eax
lea eax, [esp + 0x44]
push eax
push str.update
lea eax, [esp + 0x28]
call fcn.00406440
test eax, eax
je 0x407397
mov ecx, dword [esp + 0x44]
push ecx
call fcn.004b840e
add esp, 4
mov dword [0x5154f8], eax
lea edx, [esp + 0x44]
push edx
push str.runexe
lea eax, [esp + 0x28]
call fcn.00406440
test eax, eax
je 0x4073bc
lea edi, [ebp + 0x3c]
lea eax, [esp + 0x44]
call fcn.00401410
xor edi, edi
lea eax, [esp + 0x44]
push eax
push str.runexeargv
lea eax, [esp + 0x28]
call fcn.00406440
test eax, eax
je 0x4073e1
lea edi, [ebp + 0x40]
lea eax, [esp + 0x44]
call fcn.00401410
xor edi, edi
lea ecx, [esp + 0x44]
push ecx
push str.restallforbr
lea eax, [esp + 0x28]
call fcn.00406440
test eax, eax
je 0x407400
mov dword [ebp + 0x14], ebx
call fcn.0040b730
lea edx, [esp + 0x44]
push edx
push str.supply
lea eax, [esp + 0x28]
call fcn.00406440
test eax, eax
je 0x407439
mov esi, dword [esp + 0x44]
push esi
push str.supply_is__ws
mov ecx, 0x5158b0
call fcn.00489840
push esi
call fcn.004b840e
add esp, 0xc
mov dword [0x5157c8], eax
lea eax, [esp + 0x44]
push eax
push str.DefaultIE
lea eax, [esp + 0x28]
call fcn.00406440
test eax, eax
je 0x407475
mov ecx, dword [esp + 0x44]
push ecx
push str.DefaultIE_is__ws
mov ecx, 0x5158b0
call fcn.00489840
add esp, 8
lea edi, [ebp + 0x44]
lea eax, [esp + 0x44]
call fcn.00401410
xor edi, edi
lea edx, [esp + 0x44]
push edx
push str.handle
lea eax, [esp + 0x28]
call fcn.00406440
test eax, eax
je 0x4074ae
mov esi, dword [esp + 0x44]
push esi
push str.handle_is__s
mov ecx, 0x5158b0
call fcn.00489840
push esi
call fcn.004b840e
add esp, 0xc
mov dword [0x5157fc], eax
lea eax, [esp + 0x44]
push eax
push str.DriverPath
lea eax, [esp + 0x28]
call fcn.00406440
test eax, eax
je 0x407536
mov eax, dword [esp + 0x44]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
call fcn.004012e0
add eax, 0x10
lea ecx, [esp + 0x20]
mov dword [esi], eax
call fcn.00407730
mov byte [esp + 0x3c], 4
mov ecx, dword [esp + 0x1c]
push ecx
push str.DriverPath_is__ws
mov ecx, 0x5158b0
call fcn.00489840
add esp, 8
lea eax, [esp + 0x1c]
mov edi, 0x5157c0
call fcn.00401410
mov byte [esp + 0x3c], bl
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407534
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor edi, edi
lea ecx, [esp + 0x44]
push ecx
push 0x4f0038
lea eax, [esp + 0x28]
call fcn.00406440
test eax, eax
mov esi, dword [esp + 0x44]
je 0x407628
mov dword [esp + 0x18], edi
mov byte [esp + 0x3c], 5
mov edx, dword [0x5143cc]
mov eax, dword [edx + 0xc]
mov ecx, 0x5143cc
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x3c], 6
mov eax, dword [esp + 0x18]
cmp eax, edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x40758b
push eax
call ebp
lea ecx, [esp + 0x18]
push ecx
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push str.Version
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x24]
call fcn.00409930
mov eax, dword [esp + 0x1c]
cmp dword [eax - 0xc], edi
je 0x407600
push 0x4f0068
mov ecx, 0x5158b0
call fcn.00489840
add esp, 4
lea ecx, [esp + 0x1c]
call fcn.004016d0
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x4075e6
push eax
call ebp
lea ecx, [esp + 0x44]
mov dword [esp + 0x18], edi
call fcn.004016d0
lea ebx, [esp + 0x20]
call fcn.00408610
xor eax, eax
jmp 0x407657
push esi
call fcn.004b840e
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [0x515688], ebx
mov dword [0x51568c], eax
call fcn.004016d0
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x407628
push eax
call ebp
lea eax, [esi - 0x10]
mov byte [esp + 0x3c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407649
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ebx, [esp + 0x20]
call fcn.00408610
mov eax, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4