Function at 0x42a190
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497326
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xd74
mov eax, dword [0x4d406c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x648], ecx
push 0x402
lea eax, [ebp - 0x630]
mov byte [ebp - 0xd40], 0
push 0
push eax
mov dword [ebp - 0xd3c], 0
call fcn.0045f220
add esp, 0xc
mov dword [ebp - 0x64c], 0x400
lea eax, [ebp - 0x228]
push 0x20a
push 0
push eax
call fcn.0045f220
add esp, 0xc
mov dword [ebp - 0x644], 0
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x42a268
lea eax, [ebp - 0x644]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0x644]
mov dword [ebp - 0x644], ecx
jmp 0x42a26e
mov ecx, dword [ebp - 0x644]
test ecx, ecx
mov esi, 1
mov edx, 0x201
lea ecx, [ebp - 0xd3c]
push ecx
mov eax, esi
cmovne eax, edx
push eax
push 0
push str.SOFTWARETencentQQPCMgr
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42a32d
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0x630]
push eax
push 0
push 0
push str.ExeString
push dword [ebp - 0xd3c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42a30b
push 0xffffffffffffffff
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x228]
push 0x104
push eax
call fcn.00465b54
add esp, 0x10
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42a30b
test al, 0x10
mov eax, dword [ebp - 0xd40]
movzx eax, al
cmove eax, esi
mov dword [ebp - 0xd40], eax
push dword [ebp - 0xd3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0xd40], 0
je 0x42a32d
call fcn.00423700
test al, al
jne 0x42a5c0
call fcn.004232e0
mov edx, eax
cmp dword [edx + 4], 0
je 0x42a35b
mov eax, dword [ebp - 0xd40]
movzx ecx, al
push 0
lea ecx, [ecx*2 + 0x1b]
push ecx
push 0xbd5
push dword [edx + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x6e8
lea eax, [ebp - 0xd38]
push 0
push eax
call fcn.0045f220
add esp, 0xc
lea ecx, [ebp - 0xd38]
push 1
push 6
call fcn.0040bfe0
sub esp, 0x10
mov dword [ebp - 4], 0
movaps xmm0, xmmword [0x4bedd0]
lea ecx, [ebp - 0xd38]
mov eax, esp
sub esp, 8
push dword [ebp - 0x648]
movups xmmword [eax], xmm0
call fcn.0040d0c0
cmp eax, 1
jne 0x42a5b5
call fcn.004331b0
push 0
push 0x4bba50
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x42a587
lea eax, [ebp - 0x648]
mov dword [ebp - 0x648], 0
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x648]
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
xorps xmm0, xmm0
movups xmmword [ebp - 0x640], xmm0
movups xmmword [ebp - 0x640], xmm0
mov byte [ebp - 4], 1
lea eax, [ebp - 0xd80]
push eax
push 0
lea ecx, [ebp - 0x640]
mov dword [ebp - 0xd70], 0x67
mov dword [ebp - 0xd6c], 0
mov dword [ebp - 0xd68], 3
mov byte [ebp - 0xd64], 0
mov dword [ebp - 0xd60], 0x64
mov dword [ebp - 0xd5c], str.QQPCDownload45038.exe
mov byte [ebp - 0xd54], 0
mov dword [ebp - 0xd58], 0x2c
mov dword [ebp - 0xd50], 0x64
mov dword [ebp - 0xd4c], 0x4b6760
mov byte [ebp - 0xd44], 0
mov dword [ebp - 0xd48], 2
mov dword [ebp - 0xd80], 0x64
mov dword [ebp - 0xd7c], str.http:__dlied6.qq.com_invc_xfspeed_qqpcmgr_download_QQPCDownload45038.exe
mov byte [ebp - 0xd74], 0
mov dword [ebp - 0xd78], 0x92
call fcn.0042c080
mov eax, dword [ebp - 0x63c]
cmp dword [ebp - 0x638], eax
je 0x42a4d9
movups xmm0, xmmword [ebp - 0xd50]
movups xmmword [eax], xmm0
mov eax, dword [ebp - 0x63c]
add eax, 0x10
mov dword [ebp - 0x63c], eax
jmp 0x42a4f2
lea ecx, [ebp - 0xd50]
push ecx
push eax
lea ecx, [ebp - 0x640]
call fcn.0042c080
mov eax, dword [ebp - 0x63c]
cmp dword [ebp - 0x638], eax
je 0x42a515
movups xmm0, xmmword [ebp - 0xd60]
movups xmmword [eax], xmm0
mov eax, dword [ebp - 0x63c]
add eax, 0x10
mov dword [ebp - 0x63c], eax
jmp 0x42a52e
lea ecx, [ebp - 0xd60]
push ecx
push eax
lea ecx, [ebp - 0x640]
call fcn.0042c080
mov eax, dword [ebp - 0x63c]
cmp dword [ebp - 0x638], eax
je 0x42a549
movups xmm0, xmmword [ebp - 0xd70]
movups xmmword [eax], xmm0
add dword [ebp - 0x63c], 0x10
jmp 0x42a55c
lea ecx, [ebp - 0xd70]
push ecx
push eax
lea ecx, [ebp - 0x640]
call fcn.0042c080
sub esp, 8
lea ecx, [ebp - 0x640]
push esi
call fcn.00423ef0
mov eax, dword [ebp - 0x634]
test eax, eax
je 0x42a57c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x640]
call fcn.00423e30
call fcn.004232e0
mov edx, eax
cmp dword [edx + 4], 0
je 0x42a5b5
mov eax, dword [ebp - 0xd40]
movzx ecx, al
push 0
lea ecx, [ecx*2 + 0x1c]
push ecx
push 0xbd5
push dword [edx + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0xd38]
call fcn.0040c2b0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045cf38
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret