Function at 0x4334c0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push esi
push edi
push ecx
lea edi, [ebp - 0x154]
mov ecx, 0x55
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xf8], htons
mov dword [ebp - 0xf4], 0x4b8e58
mov dword [ebp - 0xf0], htons
mov dword [ebp - 0xec], 0x4b8e64
mov dword [ebp - 0xe8], htons
mov dword [ebp - 0xe4], 0x4b8e78
mov dword [ebp - 0xe0], htons
mov dword [ebp - 0xdc], 0x4b8e84
mov dword [ebp - 0xd8], htons
mov dword [ebp - 0xd4], 0x4b8ea0
mov dword [ebp - 0xd0], htons
mov dword [ebp - 0xcc], 0x4b8eac
mov dword [ebp - 0xc8], htons
mov dword [ebp - 0xc4], str..qpak
mov dword [ebp - 0xc0], htons
mov dword [ebp - 0xbc], str.qpakfile
mov dword [ebp - 0xb8], htons
mov dword [ebp - 0xb4], str..qbox
mov dword [ebp - 0xb0], htons
mov dword [ebp - 0xac], str.QQPCMgr.qbox
mov dword [ebp - 0xa8], htons
mov dword [ebp - 0xa4], str..qmb
mov dword [ebp - 0xa0], htons
mov dword [ebp - 0x9c], str.qmbfile
mov dword [ebp - 0x98], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x94], 0x4b8f20
mov dword [ebp - 0x90], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x8c], str.SoftwareMicrosoftWindowsCurrentVersionUninstallQQPCMgr
mov dword [ebp - 0x88], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x84], str.SOFTWARETENCENTDeskUpdateQQSoftMgr
mov dword [ebp - 0x80], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], 0x4b9030
mov dword [ebp - 0x78], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x74], str.SYSTEMCurrentControlSetServicesTSSysKit
mov dword [ebp - 0x70], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x6c], str.SYSTEMCurrentControlSetServicesTsNetMon
mov dword [ebp - 0x68], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x64], str.SYSTEMCurrentControlSetServicesTSCPM
mov dword [ebp - 0x60], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x5c], str.SYSTEMCurrentControlSetServicesQQFolderCrypt
mov dword [ebp - 0x58], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x54], str.SYSTEMCurrentControlSetServicesTCSafeBox
mov dword [ebp - 0x50], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x4c], str.SYSTEMCurrentControlSetServicesQQFileFilter
mov dword [ebp - 0x48], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x44], str.SYSTEMCurrentControlSetServicesQqNetflpwControl
mov dword [ebp - 0x40], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x3c], str.SYSTEMCurrentControlSetServicesTSCPM64
mov dword [ebp - 0x38], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x34], str.SYSTEMCurrentControlSetServicesQQSysMon
mov dword [ebp - 0x30], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2c], str.SYSTEMCurrentControlSetServicesQQSysMonX64
mov dword [ebp - 0x28], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x24], str.SYSTEMCurrentControlSet_servicesTSDefenseBt
mov dword [ebp - 0x20], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1c], str.SYSTEMCurrentControlSet_servicesQQPCHelper
mov dword [ebp - 0x18], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], str.SYSTEMCurrentControlSet_servicesQMIEProtect
mov dword [ebp - 0x10], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], str.SYSTEMCurrentControlSetServicesTSSysFix
mov dword [ebp - 0x100], 0
jmp 0x4336fb
mov eax, dword [ebp - 0x100]
add eax, 1
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0x1e
jae 0x43372a
mov ecx, dword [ebp - 0x100]
mov edx, dword [ebp + ecx*8 - 0xf4]
push edx
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp + eax*8 - 0xf8]
push ecx
call fcn.004316a0
add esp, 8
jmp 0x4336ec
mov dword [ebp - 0x14c], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x148], 0x4b9600
mov dword [ebp - 0x144], 0x4b901c
mov dword [ebp - 0x140], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x13c], 0x4b9660
mov dword [ebp - 0x138], str.QQPCLaunch
mov dword [ebp - 0x134], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x130], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [ebp - 0x12c], str._QQPCTray
mov dword [ebp - 0x128], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x124], str.SYSTEMCurrentControlSetServicesTSKSP
mov dword [ebp - 0x120], 0x4b9798
mov dword [ebp - 0x11c], htons
mov dword [ebp - 0x118], str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov dword [ebp - 0x114], str.QQPCClinic
mov dword [ebp - 0x110], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10c], str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov dword [ebp - 0x108], str.QQPCTray
mov dword [ebp - 0x154], 0
jmp 0x4337f9
mov edx, dword [ebp - 0x154]
add edx, 1
mov dword [ebp - 0x154], edx
cmp dword [ebp - 0x154], 6
jae 0x43383f
mov eax, dword [ebp - 0x154]
imul eax, eax, 0xc
mov ecx, dword [ebp + eax - 0x144]
push ecx
mov edx, dword [ebp - 0x154]
imul edx, edx, 0xc
mov eax, dword [ebp + edx - 0x148]
push eax
mov ecx, dword [ebp - 0x154]
imul ecx, ecx, 0xc
mov edx, dword [ebp + ecx - 0x14c]
push edx
call fcn.004317b0
add esp, 0xc
jmp 0x4337ea
push str.CallUnRegUrlProtocol
mov esi, 0x4d1508
call fcn.00481e10
add esp, 4
push str.QQPCMgr.WebGame
mov ecx, dword [ebp - 4]
call fcn.004346c0
push str.QQPCMgr.QQPCSafebox
mov ecx, dword [ebp - 4]
call fcn.004346c0
push str.PCMgrRepairIEExtensions
mov ecx, dword [ebp - 4]
call fcn.004346c0
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x4338a0]
call fcn.004a5771
pop eax
pop edx
pop edi
pop esi
add esp, 0x154
cmp ebp, esp
call fcn.004a574e
mov esp, ebp
pop ebp
ret