Function at 0x451dc0
Capabilities:
Check if file exists
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d56a0
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebx + 0xc]
call fcn.0043f7c0
test eax, eax
jne 0x4521e7
mov dword [ebp - 0x5c], eax
mov dword [ebp - 4], eax
lea esi, [ebx + 4]
mov edx, dword [esi]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
cmp word [edx], ax
jne 0x451e1f
xor ecx, ecx
jmp 0x451e33
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x451e24
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.004393e0
push str.npQMExtensionsMozilla.dll
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0048d880
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x451f32
call fcn.00488a60
test eax, eax
mov eax, dword [ebp - 0x5c]
jne 0x451e9b
test eax, eax
je 0x451e81
push eax
call edi
push 0
lea eax, [ebp - 0x5c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMozillaPlugins_qq.com_QQPCMgr
jmp 0x451eba
test eax, eax
je 0x451ea2
push eax
call edi
push 0
lea eax, [ebp - 0x5c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREWow6432NodeMozillaPlugins_qq.com_QQPCMgr
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x5c], 0
call eax
test eax, eax
jne 0x451f32
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x5c]
cmovae eax, dword [ebp - 0x28]
push eax
push str.Path
call fcn.0043fb50
push str.QQPCMgr_Detector
push str.Description
lea ecx, [ebp - 0x5c]
call fcn.0043fb50
push str.QQPCMgr_Detector
push 0x4f3128
lea ecx, [ebp - 0x5c]
call fcn.0043fb50
push 0x4f3140
push str.Vendor
lea ecx, [ebp - 0x5c]
call fcn.0043fb50
push str.2.0.0.2
push str.Version
lea ecx, [ebp - 0x5c]
call fcn.0043fb50
mov edx, dword [esi]
cmp word [edx], 0
jne 0x451f3e
xor ecx, ecx
jmp 0x451f56
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x64], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x451f46
sub ecx, dword [ebp - 0x64]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.004393e0
push str.QQPCClinic.exe
lea ecx, [ebp - 0x28]
call fcn.0048d880
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x452047
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicy_
lea ecx, [ebp - 0x64]
call fcn.0041c9e0
push 0x26
push str.16EE6530_8649_4F42_A9E4_F6A3295AF975
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.0041c4b0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x451fb7
push eax
call edi
push 0
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp - 0x60]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x452028
push dword [esi]
lea ecx, [ebp - 0x5c]
push str.AppPath
call fcn.0043fb50
push str.QQPCClinic.exe
push str.AppName
lea ecx, [ebp - 0x5c]
call fcn.0043fb50
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], 3
test eax, eax
je 0x452028
push 4
lea ecx, [ebp - 0x60]
push ecx
push 4
push 0
push str.Policy
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov edx, dword [ebp - 0x64]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x452047
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.Set_Relation_File_Type
push 0x515408
call fcn.0048be90
add esp, 8
cmp dword [0x5153a8], 0
je 0x452095
push str.IsConvertInstall_TRUE
push 0x515408
call fcn.0048be90
add esp, 8
cmp dword [ebx + 0x48], 0
jne 0x452081
push str.m_bFileOpenWasSet_TRUE
jmp 0x45209a
push str.m_bFileOpenWasSet_FALSE
push 0x515408
call fcn.0048be90
add esp, 8
jmp 0x4520ad
push str.IsConvertInstall_FALSE
push 0x515408
call fcn.0048be90
add esp, 8
push esi
call fcn.00452a10
push str.Reload_WebClinic
push 0x515408
call fcn.0048be90
add esp, 4
mov ecx, esp
push str.QQPCMgr.WebGame
call fcn.0041c9e0
call fcn.00452f00
push ecx
mov ecx, esp
push str.QQPCMgr.QQPCSafebox
call fcn.0041c9e0
call fcn.00452f00
push ecx
mov ecx, esp
push str.PCMgrRepairIEExtensions
call fcn.0041c9e0
call fcn.00452f00
push str.QQPCMgr.exe
mov edx, esi
lea ecx, [ebp - 0x60]
call fcn.0041c030
add esp, 4
mov byte [ebp - 4], 3
push dword [eax]
sub esp, 8
call fcn.00452fc0
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov edx, dword [ebp - 0x60]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x452133
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [esi]
lea ecx, [ebp - 0x40]
call fcn.00438880
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x58]
call fcn.00453740
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x452166
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00433850
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.00453d10
test eax, eax
je 0x45218b
lea ecx, [ebp - 0x58]
call fcn.00453890
mov eax, dword [ebp - 0x44]
cmp eax, 8
jb 0x4521a0
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.00433850
xor eax, eax
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], 0
cmp eax, 8
jb 0x4521c9
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00433850
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x18], 0
test eax, eax
je 0x4521e7
push eax
call edi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a474b
mov esp, ebp
pop ebp
ret