Function at 0x450890
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push esi
push edi
push ecx
lea edi, [ebp - 0x158]
mov ecx, 0x56
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x108], VariantClear
mov dword [ebp - 0x104], 0x4d9370
mov dword [ebp - 0x100], VariantClear
mov dword [ebp - 0xfc], 0x4d937c
mov dword [ebp - 0xf8], VariantClear
mov dword [ebp - 0xf4], 0x4d9390
mov dword [ebp - 0xf0], VariantClear
mov dword [ebp - 0xec], 0x4d939c
mov dword [ebp - 0xe8], VariantClear
mov dword [ebp - 0xe4], 0x4d93b8
mov dword [ebp - 0xe0], VariantClear
mov dword [ebp - 0xdc], 0x4d93c4
mov dword [ebp - 0xd8], VariantClear
mov dword [ebp - 0xd4], str..qpak
mov dword [ebp - 0xd0], VariantClear
mov dword [ebp - 0xcc], str.qpakfile
mov dword [ebp - 0xc8], VariantClear
mov dword [ebp - 0xc4], str..qbox
mov dword [ebp - 0xc0], VariantClear
mov dword [ebp - 0xbc], str.QQPCMgr.qbox
mov dword [ebp - 0xb8], VariantClear
mov dword [ebp - 0xb4], str..qmb
mov dword [ebp - 0xb0], VariantClear
mov dword [ebp - 0xac], str.qmbfile
mov dword [ebp - 0xa8], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xa4], str.SoftwareMicrosoftWindowsCurrentVersionUninstallQQPCMgr
mov dword [ebp - 0xa0], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x9c], str.SOFTWARETENCENTDeskUpdateQQSoftMgr
mov dword [ebp - 0x98], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x94], 0x4d9510
mov dword [ebp - 0x90], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x8c], str.SYSTEMCurrentControlSetServicesTSSysKit
mov dword [ebp - 0x88], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x84], str.SYSTEMCurrentControlSetServicesTsNetMon
mov dword [ebp - 0x80], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], str.SYSTEMCurrentControlSetServicesTSCPM
mov dword [ebp - 0x78], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x74], str.SYSTEMCurrentControlSetServicesQQFolderCrypt
mov dword [ebp - 0x70], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x6c], str.SYSTEMCurrentControlSetServicesTCSafeBox
mov dword [ebp - 0x68], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x64], str.SYSTEMCurrentControlSetServicesQQFileFilter
mov dword [ebp - 0x60], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x5c], str.SYSTEMCurrentControlSetServicesQqNetflpwControl
mov dword [ebp - 0x58], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x54], str.SYSTEMCurrentControlSetServicesTSCPM64
mov dword [ebp - 0x50], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x4c], str.SYSTEMCurrentControlSetServicesQQSysMon
mov dword [ebp - 0x48], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x44], str.SYSTEMCurrentControlSetServicesQQSysMonX64
mov dword [ebp - 0x40], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x3c], str.SYSTEMCurrentControlSet_servicesTSDefenseBt
mov dword [ebp - 0x38], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x34], str.SYSTEMCurrentControlSet_servicesQQPCHelper
mov dword [ebp - 0x30], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2c], str.SYSTEMCurrentControlSet_servicesQMIEProtect
mov dword [ebp - 0x28], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x24], str.SYSTEMCurrentControlSet_servicesTS888
mov dword [ebp - 0x20], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1c], str.SYSTEMCurrentControlSet_servicesTS888x64
mov dword [ebp - 0x18], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], str.SYSTEMCurrentControlSet_services_aghelp28
mov dword [ebp - 0x10], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], str.SYSTEMCurrentControlSet_services_aghelp28x64
mov dword [ebp - 0x110], 0
jmp 0x450af3
mov eax, dword [ebp - 0x110]
add eax, 1
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x20
jae 0x450b22
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp + ecx*8 - 0x104]
push edx
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp + eax*8 - 0x108]
push ecx
call fcn.0044e990
add esp, 8
jmp 0x450ae4
mov dword [ebp - 0x150], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14c], 0x4d9be8
mov dword [ebp - 0x148], 0x4d94fc
mov dword [ebp - 0x144], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x140], 0x4d9c60
mov dword [ebp - 0x13c], str.QQPCLaunch
mov dword [ebp - 0x138], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x134], str.SYSTEMCurrentControlSetServicesTSKSP
mov dword [ebp - 0x130], 0x4d9d28
mov dword [ebp - 0x12c], VariantClear
mov dword [ebp - 0x128], str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov dword [ebp - 0x124], str.QQPCClinic
mov dword [ebp - 0x120], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x11c], str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov dword [ebp - 0x118], str.QQPCTray
mov dword [ebp - 0x158], 0
jmp 0x450bd3
mov edx, dword [ebp - 0x158]
add edx, 1
mov dword [ebp - 0x158], edx
cmp dword [ebp - 0x158], 5
jae 0x450c19
mov eax, dword [ebp - 0x158]
imul eax, eax, 0xc
mov ecx, dword [ebp + eax - 0x148]
push ecx
mov edx, dword [ebp - 0x158]
imul edx, edx, 0xc
mov eax, dword [ebp + edx - 0x14c]
push eax
mov ecx, dword [ebp - 0x158]
imul ecx, ecx, 0xc
mov edx, dword [ebp + ecx - 0x150]
push edx
call fcn.0044eaa0
add esp, 0xc
jmp 0x450bc4
push str.CallUnRegUrlProtocol
mov esi, 0x4f8948
call fcn.0048aa50
add esp, 4
push str.QQPCMgr.WebGame
mov ecx, dword [ebp - 4]
call fcn.00451aa0
push str.QQPCMgr.QQPCSafebox
mov ecx, dword [ebp - 4]
call fcn.00451aa0
push str.PCMgrRepairIEExtensions
mov ecx, dword [ebp - 4]
call fcn.00451aa0
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x450c78]
call fcn.004c3b59
pop eax
pop edx
pop edi
pop esi
add esp, 0x158
cmp ebp, esp
call fcn.004c3b36
mov esp, ebp
pop ebp
ret