Function at 0x4360c0
Capabilities:
Persist via run registry key

Disassembly:
push 0xffffffffffffffff
push 0x4cab0d
mov eax, dword fs:[0]
push eax
sub esp, 0x4ac
mov eax, dword [0x4f8458]
xor eax, esp
mov dword [esp + 0x4a8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f8458]
xor eax, esp
push eax
lea eax, [esp + 0x4c0]
mov dword fs:[0], eax
call fcn.00430300
xor edi, edi
test eax, eax
lea ebp, [edi + 7]
je 0x436321
mov eax, dword [0x5005fc]
cmp eax, edi
mov dword [esp + 0x18], eax
jne 0x436137
call fcn.0042fea0
cmp eax, edi
jne 0x436137
push str.ShellCopy_CloseSelfProtect_Error_
push 2
push str..UnitInstallHelper.cpp
call fcn.004bc3d0
add esp, 0xc
lea eax, [esp + 0x58]
push eax
call fcn.00430190
add esp, 4
push eax
mov ebx, str.QQPCLaunch.exe
lea esi, [esp + 0x94]
mov dword [esp + 0x4cc], edi
call fcn.00407cc0
add esp, 4
mov byte [esp + 0x4c8], 2
cmp dword [esp + 0x70], 8
jb 0x43617c
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.00493b60
add esp, 4
lea eax, [esp + 0x20]
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], edi
mov word [esp + 0x5c], di
call fcn.004bb1e0
push eax
mov ebx, str.ProgramDataLink.exe
lea esi, [esp + 0x78]
mov byte [esp + 0x4cc], 3
call fcn.00407cc0
add esp, 4
mov esi, 8
mov byte [esp + 0x4c8], 5
cmp dword [esp + 0x38], esi
jb 0x4361cc
mov edx, dword [esp + 0x24]
push edx
call fcn.00493b60
add esp, 4
cmp dword [esp + 0xa8], esi
mov ecx, dword [esp + 0x94]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], edi
mov word [esp + 0x24], di
jae 0x4361f0
lea ecx, [esp + 0x94]
cmp dword [esp + 0x8c], esi
mov eax, dword [esp + 0x78]
jae 0x436201
lea eax, [esp + 0x78]
push edi
push ecx
push eax
call dword [0x4cf374]
test eax, eax
jne 0x436227
push str.cant_copy_shell.exe
push 2
push str..UnitInstallHelper.cpp
call fcn.004bc3d0
add esp, 0xc
jmp 0x4362d2
push 0x206
lea eax, [esp + 0xb2]
push edi
push eax
mov word [esp + 0xb8], di
call fcn.0049d900
add esp, 0xc
push 0x104
lea ecx, [esp + 0xb0]
push ecx
push edi
call dword [0x4cf2d8]
lea edx, [esp + 0x3c]
push edx
call fcn.00430190
add esp, 4
push eax
mov ebx, str.QDeskPath.ini
lea esi, [esp + 0x5c]
mov byte [esp + 0x4cc], 6
call fcn.00407cc0
mov esi, 8
add esp, 4
cmp dword [esp + 0x54], esi
jb 0x436298
mov eax, dword [esp + 0x40]
push eax
call fcn.00493b60
add esp, 4
cmp dword [esp + 0x70], esi
mov eax, dword [esp + 0x5c]
jae 0x4362a6
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0xb0]
push ecx
push str.path
push str.config
call dword [0x4cf110]
cmp dword [esp + 0x70], esi
jb 0x4362d2
mov edx, dword [esp + 0x5c]
push edx
call fcn.00493b60
add esp, 4
cmp dword [esp + 0x18], edi
jne 0x4362dd
call fcn.0042ff30
cmp dword [esp + 0x8c], esi
jb 0x4362f3
mov eax, dword [esp + 0x78]
push eax
call fcn.00493b60
add esp, 4
cmp dword [esp + 0xa8], esi
mov dword [esp + 0x8c], ebp
mov dword [esp + 0x88], edi
mov word [esp + 0x78], di
jb 0x436335
mov ecx, dword [esp + 0x94]
push ecx
call fcn.00493b60
add esp, 4
jmp 0x436335
push str.cant_find_QQPCMgr
push 2
push str..UnitInstallHelper.cpp
call fcn.004bc3d0
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push 1
push edi
mov dword [esp + 0x4d4], ebp
mov ebp, dword [0x4cf030]
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
mov dword [esp + 0x2c], edi
call ebp
cmp eax, edi
jne 0x436409
mov ebx, dword [esp + 0x18]
push 0x206
lea eax, [esp + 0x2ba]
push edi
push eax
mov dword [esp + 0x28], ebx
mov word [esp + 0x2c0], di
call fcn.0049d900
add esp, 0xc
push str.QQPCLaunch
lea ecx, [esp + 0x20]
push ecx
lea esi, [esp + 0x20]
lea edx, [esp + 0x2bc]
mov dword [esp + 0x20], 0x104
call fcn.00434870
cmp eax, edi
jne 0x4363fe
lea edx, [esp + 0x18]
push edx
push 0x20006
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov byte [esp + 0x4d8], 8
push 0x80000002
mov dword [esp + 0x2c], edi
call ebp
cmp eax, edi
jne 0x4363fe
mov esi, dword [esp + 0x18]
push str.QQPCLaunch
push esi
mov dword [esp + 0x20], esi
call dword [section..rdata]
push 1
call fcn.00436a70
add esp, 4
cmp esi, edi
je 0x4363fe
push esi
call dword [0x4cf008]
cmp ebx, edi
je 0x436409
push ebx
call dword [0x4cf008]
mov ecx, dword [esp + 0x4c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4a8]
xor ecx, esp
call fcn.00493b65
add esp, 0x4b8
ret