Function at 0x441410
Capabilities:
Check if file exists
Delete registry value
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4470
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0041c9e0
push 1
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x10]
call fcn.0041c100
mov ecx, str.0s
mov eax, dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x441488
test dx, dx
je 0x441484
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x441488
add eax, 4
add ecx, 4
test dx, dx
jne 0x441462
xor eax, eax
jmp 0x44148d
sbb eax, eax
or eax, 1
mov edx, dword [ebp + 8]
test eax, eax
setne bl
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4414ad
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x4414c0
push 1
push str.0s
lea ecx, [ebp - 0x10]
call fcn.0041c4b0
push 0xb
push str.QQPCRtp.exe
lea ecx, [ebp - 0x10]
call fcn.0041c4b0
mov esi, 3
mov dword [ebp - 0x1c], esi
cmp dword [0x5153a8], 0
jne 0x4414ed
cmp dword [0x51536c], 0
jne 0x44191c
mov ecx, str.QQPCRtp.exe
call fcn.0048ed80
push 0
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesQQPCrtp
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4418f7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], 4
test eax, eax
je 0x441572
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
push 0
push str.DeleteFlag
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x441572
cmp dword [ebp - 0x2c], 4
jne 0x441572
mov eax, dword [ebp + 8]
test eax, eax
je 0x441572
push str.DeleteFlag
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
call fcn.0041bef0
test eax, eax
je 0x4419df
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
push str.ImagePath
lea ecx, [ebp + 8]
call fcn.0043fa60
mov ebx, dword [ebp - 0x18]
test eax, eax
je 0x4418db
lea ecx, [ebx - 0x10]
call fcn.0041c6e0
lea esi, [eax + 0x10]
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 3
mov edi, dword [esi - 0xc]
test edi, edi
js 0x4419d5
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x4415e6
push edi
lea ecx, [ebp - 0x20]
call fcn.0041cbd0
mov esi, dword [ebp - 0x20]
lea eax, [edi + 1]
push eax
push esi
call fcn.004b0e82
add esp, 8
cmp edi, dword [esi - 8]
jg 0x4419d5
mov dword [esi - 0xc], edi
xor eax, eax
mov word [esi + edi*2], ax
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.0041c6e0
lea edi, [eax + 0x10]
mov dword [ebp - 0x24], edi
mov byte [ebp - 4], 4
mov edx, dword [edi - 0xc]
mov dword [ebp - 0x28], edx
test edx, edx
js 0x4419d5
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, edx
or eax, ecx
jge 0x441648
push edx
lea ecx, [ebp - 0x24]
call fcn.0041cbd0
mov edi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
lea eax, [edx + 1]
push eax
push edi
call fcn.004b0e82
mov eax, dword [ebp - 0x28]
add esp, 8
cmp eax, dword [edi - 8]
jg 0x4419d5
xor ecx, ecx
mov dword [edi - 0xc], eax
mov word [edi + eax*2], cx
cmp dword [esi - 0xc], ecx
jl 0x44168a
push edi
push esi
call fcn.004a6c3e
add esp, 8
test eax, eax
je 0x44168a
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
jne 0x441954
push esi
push 0x4ef74c
push 0x515408
call fcn.0048c0f0
push edi
push 0x4ef778
push 0x515408
call fcn.0048c0f0
push 0x4ef790
push 0x515408
call fcn.0048c0f0
add esp, 0x20
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4416df
mov ecx, dword [ebp - 0x10]
mov edx, 0x4ef7d8
push 0
push 0
push 0xffffffffffffffff
call fcn.0048eb00
add esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], 0
test eax, eax
je 0x441706
push 4
lea ecx, [ebp - 0x28]
push ecx
push 4
push 0
push str.RtpFlag
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], pe_nt_image_headers32
test eax, eax
je 0x44172a
push 4
lea ecx, [ebp - 0x28]
push ecx
push 4
push 0
push str.Type
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], 1
test eax, eax
je 0x44174e
push 4
lea ecx, [ebp - 0x28]
push ecx
push 4
push 0
push str.ErrorControl
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], 2
test eax, eax
je 0x4417eb
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push 0
push str.Start
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 8]
test eax, eax
je 0x4417eb
push 0x28
push str.QQPCMgr_RTP_Service
push 1
push 0
push 0x4ef380
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 8]
test eax, eax
je 0x4417eb
push 0x26
push str.COM_Infrastructure
push 1
push 0
push str.Group
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 8]
test eax, eax
je 0x4417eb
push 0x18
push str.LocalSystem
push 1
push 0
push str.ObjectName
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 8]
test eax, eax
je 0x4417eb
push 0x1a
push 0x4ef854
push 1
push 0
push str.Description
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x4edd30
lea ecx, [ebp - 0x14]
call fcn.0041c9e0
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 5
mov edx, dword [eax + 4]
test edx, edx
jne 0x44180a
xor ecx, ecx
jmp 0x441822
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x28], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x441812
sub ecx, dword [ebp - 0x28]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x14]
call fcn.0041c4b0
push 0xf
push str.QQPCRtp.exe___r
lea ecx, [ebp - 0x14]
call fcn.0041c4b0
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x441881
mov eax, dword [ebp - 0x14]
mov ebx, eax
lea edx, [ebx + 2]
mov dword [ebp - 0x38], edx
nop dword [eax]
mov dx, word [ebx]
add ebx, 2
test dx, dx
jne 0x441850
mov dword [ebp - 0x28], ebx
mov edx, ebx
sub edx, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x18]
sar edx, 1
lea edx, [edx*2 + 2]
push edx
push eax
push 1
push 0
push str.ImagePath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 4
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4418a0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4418bc
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4418d8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x1c]
mov byte [ebp - 4], 1
add ebx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x4418f7
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
dec esi
mov byte [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], esi
test eax, eax
je 0x44190d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], 0
test esi, esi
jg 0x4414d7
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44193e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.RepairQQPCRtp_RTP
push 0x515408
call fcn.0048c0f0
add esp, 8
mov byte [ebp - 4], 3
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x441982
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
or edi, 0xffffffff
mov byte [ebp - 4], 2
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4419a0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
add ebx, 0xfffffff0
mov eax, edi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x4419bb
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 8]
test eax, eax
je 0x4419c9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], 0
jmp 0x44191c
push 0x80070057
call fcn.0041ce60
push 0x80004005
call fcn.0041ce60
int3