Function at 0x4357e0
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d49f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x10], edi
push 0x4ee458
push 0x48
mov dword [ebp - 4], edi
call fcn.00437390
push 0x4ee468
push 0x515488
call fcn.0048cf90
add esp, 4
mov esi, esp
mov dword [ebp - 0x14], esi
mov ecx, dword [0x5153fc]
lea ecx, [ecx - 0x10]
call fcn.0041c670
add eax, 0x10
mov dword [esi], eax
call fcn.004353c0
cmp dword [0x515428], edi
jne 0x43586f
cmp dword [0x5153ec], edi
je 0x43586f
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00435670
cmp dword [0x515428], 0
jne 0x435886
cmp dword [0x5153ec], 0
jne 0x43585b
call fcn.00437420
push 0
push 0
push 0x5153e8
push 0x435700
push 0
push 0
call fcn.004af800
add esp, 0x18
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x4ee478
push 0x4b
call fcn.00437390
push str.Write_Regedit
push 0x515488
call fcn.0048cf90
mov ecx, dword [0x515420]
xor edx, edx
mov edi, dword [0x51541c]
add esp, 8
sub ecx, edi
xor ebx, ebx
add ecx, 3
shr ecx, 2
cmp edi, dword [0x515420]
cmova ecx, edx
test ecx, ecx
je 0x435902
mov esi, ecx
nop
mov ecx, dword [edi]
call fcn.004383ef
inc ebx
lea edi, [edi + 4]
cmp ebx, esi
jne 0x4358f0
mov esi, dword [ebp - 0x10]
cmp dword [0x515428], 0
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jne 0x43591e
cmp dword [0x5153ec], 0
jne 0x435a4f
push 0x4ee494
push 0x50
call fcn.00437390
push str.InstallService
push 0x515488
call fcn.0048cf90
add esp, 8
push 0x4ee4b0
push 0x5a
call fcn.00437390
call fcn.00435460
cmp dword [0x515428], 0
jne 0x435963
cmp dword [0x5153ec], 0
jne 0x435a4f
push 0x4ee4bc
push 0x515488
call fcn.0048cf90
add esp, 8
push 0xffffffffffffffff
push esi
call edi
test esi, esi
je 0x43598a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov dword [ebp - 0x10], esi
cmp dword [0x515428], 0
jne 0x4359a0
cmp dword [0x5153ec], 0
jne 0x435a4f
push 0x4ee4e0
push 0x62
call fcn.00437390
push 0x4ee4ec
push 0x515488
call fcn.0048cf90
push str.QQPCRTP.exe
mov edx, 0x5153fc
lea ecx, [ebp - 0x14]
call fcn.0041c010
add esp, 0xc
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x14]
mov ebx, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4359f5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
je 0x435a31
push 0x4383ea
push dword [0x515420]
lea ecx, [ebp - 0x14]
push dword [0x51541c]
call fcn.00437da0
add esp, 0xc
lea ecx, [ebp - 0x14]
push 0x4383f4
push dword [0x515420]
push dword [0x51541c]
call fcn.00437da0
add esp, 0xc
push str.WriteInstallTimer
push 0x515488
call fcn.0048cf90
add esp, 8
call fcn.00437160
mov ebx, 1
jmp 0x435a51
xor ebx, ebx
test esi, esi
je 0x435a61
push 0xffffffffffffffff
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret