Function at 0x401290
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x46e018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x144], 0
push esi
push edi
cmp dword [ebx + 0x14], 8
jb 0x4012ba
mov ecx, dword [ebx]
push ecx
lea edx, [ebp - 0x144]
call fcn.00415670
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
add esp, 4
mov dword [ebp - 0x140], SysStringLen
xor esi, esi
mov dword [ebp - 0x13c], str..qpak
mov dword [ebp - 0x138], SysStringLen
mov dword [ebp - 0x134], str.qpakfile
mov dword [ebp - 0x130], SysStringLen
mov dword [ebp - 0x12c], str..qbox
mov dword [ebp - 0x128], SysStringLen
mov dword [ebp - 0x124], str.QQPCMgr.qbox
mov dword [ebp - 0x120], SysStringLen
mov dword [ebp - 0x11c], str..qmb
mov dword [ebp - 0x118], SysStringLen
mov dword [ebp - 0x114], str.qmbfile
mov dword [ebp - 0x110], SysStringLen
mov dword [ebp - 0x10c], str..qpak
mov dword [ebp - 0x108], SysStringLen
mov dword [ebp - 0x104], str.qpakfile
mov dword [ebp - 0x100], SysStringLen
mov dword [ebp - 0xfc], str..qbox
mov dword [ebp - 0xf8], SysStringLen
mov dword [ebp - 0xf4], str.QQPCMgr.qbox
mov dword [ebp - 0xf0], SysStringLen
mov dword [ebp - 0xec], str..qmb
mov dword [ebp - 0xe8], SysStringLen
mov dword [ebp - 0xe4], str.qmbfile
mov dword [ebp - 0xe0], SysStringLen
mov dword [ebp - 0xdc], 0x463274
mov dword [ebp - 0xd8], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xd4], 0x463274
mov dword [ebp - 0xd0], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xcc], str.SoftwareMicrosoftWindowsCurrentVersionUninstallQQPCMgr
mov dword [ebp - 0xc8], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc4], str.SOFTWARETENCENTDeskUpdateQQSoftMgr
mov dword [ebp - 0xc0], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xbc], str.SYSTEMCurrentControlSetServicesTSKSP
mov dword [ebp - 0xb8], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xb4], str.SYSTEMCurrentControlSetServicesTSSysKit
mov dword [ebp - 0xb0], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xac], str.SYSTEMCurrentControlSetServicesTsNetMon
mov dword [ebp - 0xa8], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xa4], str.SYSTEMCurrentControlSetServicesTSCPM
mov dword [ebp - 0xa0], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x9c], str.SYSTEMCurrentControlSetServicesQQFolderCrypt
mov dword [ebp - 0x98], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x94], str.SYSTEMCurrentControlSetServicesTCSafeBox
mov dword [ebp - 0x90], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x8c], str.SYSTEMCurrentControlSetServicesQQFileFilter
mov dword [ebp - 0x88], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x84], str.SYSTEMCurrentControlSetServicesQqNetflpwControl
mov dword [ebp - 0x80], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], str.SYSTEMCurrentControlSetServicesTSCPM64
mov dword [ebp - 0x78], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x74], str.SYSTEMCurrentControlSetServicesQQSysMon
mov dword [ebp - 0x70], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x6c], str.SYSTEMCurrentControlSetServicesQQSysMonX64
mov dword [ebp - 0x68], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x64], str.SYSTEMCurrentControlSet_servicesTSDefenseBt
mov dword [ebp - 0x60], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x5c], str.SYSTEMCurrentControlSet_servicesQQPCHelper
mov dword [ebp - 0x58], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x54], str.SYSTEMCurrentControlSet_servicesQMIEProtect
nop word [eax + eax]
push dword [ebp + esi*8 - 0x13c]
push dword [ebp + esi*8 - 0x140]
call edi
inc esi
cmp esi, 0x1e
jb 0x401510
mov dword [ebp - 0x50], reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x4c]
mov dword [ebp - 0x4c], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov edi, 6
mov dword [ebp - 0x48], str.QQPCTray
mov dword [ebp - 0x44], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x40], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [ebp - 0x3c], str.QQPCLaunch
mov dword [ebp - 0x38], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x34], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [ebp - 0x30], str._QQPCTray
mov dword [ebp - 0x2c], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x28], str.SYSTEMCurrentControlSetServicesTSKSP
mov dword [ebp - 0x24], str.InstallDir
mov dword [ebp - 0x20], SysStringLen
mov dword [ebp - 0x1c], str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov dword [ebp - 0x18], str.QQPCClinic
mov dword [ebp - 0x14], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov dword [ebp - 0xc], str.QQPCTray
nop dword [eax]
push dword [esi + 4]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea esi, [esi + 0xc]
sub edi, 1
jne 0x4015b0
mov ecx, ebx
call fcn.00401c80
mov ecx, ebx
call fcn.004015f0
mov ecx, dword [ebp - 4]
lea eax, [edi + 1]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042dc42
mov esp, ebp
pop ebp
ret