Function at 0x453f20
Capabilities:
Check if file exists
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6c40
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebx + 0xc]
call fcn.004404e0
test eax, eax
jne 0x454347
mov dword [ebp - 0x5c], eax
mov dword [ebp - 4], eax
lea esi, [ebx + 4]
mov edx, dword [esi]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
cmp word [edx], ax
jne 0x453f7f
xor ecx, ecx
jmp 0x453f93
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x453f84
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00439160
push str.npQMExtensionsMozilla.dll
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0048e980
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x454092
call fcn.0048a040
test eax, eax
mov eax, dword [ebp - 0x5c]
jne 0x453ffb
test eax, eax
je 0x453fe1
push eax
call edi
push 0
lea eax, [ebp - 0x5c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMozillaPlugins_qq.com_QQPCMgr
jmp 0x45401a
test eax, eax
je 0x454002
push eax
call edi
push 0
lea eax, [ebp - 0x5c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREWow6432NodeMozillaPlugins_qq.com_QQPCMgr
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x5c], 0
call eax
test eax, eax
jne 0x454092
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x5c]
cmovae eax, dword [ebp - 0x28]
push eax
push str.Path
call fcn.00440870
push str.QQPCMgr_Detector
push str.Description
lea ecx, [ebp - 0x5c]
call fcn.00440870
push str.QQPCMgr_Detector
push 0x4f3ba8
lea ecx, [ebp - 0x5c]
call fcn.00440870
push 0x4f3bc0
push str.Vendor
lea ecx, [ebp - 0x5c]
call fcn.00440870
push str.2.0.0.2
push str.Version
lea ecx, [ebp - 0x5c]
call fcn.00440870
mov edx, dword [esi]
cmp word [edx], 0
jne 0x45409e
xor ecx, ecx
jmp 0x4540b6
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x64], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4540a6
sub ecx, dword [ebp - 0x64]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00439160
push str.QQPCClinic.exe
lea ecx, [ebp - 0x28]
call fcn.0048e980
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4541a7
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicy_
lea ecx, [ebp - 0x64]
call fcn.0041c970
push 0x26
push str.16EE6530_8649_4F42_A9E4_F6A3295AF975
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.0041c490
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x454117
push eax
call edi
push 0
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp - 0x60]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x454188
push dword [esi]
lea ecx, [ebp - 0x5c]
push str.AppPath
call fcn.00440870
push str.QQPCClinic.exe
push str.AppName
lea ecx, [ebp - 0x5c]
call fcn.00440870
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], 3
test eax, eax
je 0x454188
push 4
lea ecx, [ebp - 0x60]
push ecx
push 4
push 0
push str.Policy
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov edx, dword [ebp - 0x64]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4541a7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.Set_Relation_File_Type
push 0x515488
call fcn.0048cf90
add esp, 8
cmp dword [0x515428], 0
je 0x4541f5
push str.IsConvertInstall_TRUE
push 0x515488
call fcn.0048cf90
add esp, 8
cmp dword [ebx + 0x48], 0
jne 0x4541e1
push str.m_bFileOpenWasSet_TRUE
jmp 0x4541fa
push str.m_bFileOpenWasSet_FALSE
push 0x515488
call fcn.0048cf90
add esp, 8
jmp 0x45420d
push str.IsConvertInstall_FALSE
push 0x515488
call fcn.0048cf90
add esp, 8
push esi
call fcn.00454b70
push str.Reload_WebClinic
push 0x515488
call fcn.0048cf90
add esp, 4
mov ecx, esp
push str.QQPCMgr.WebGame
call fcn.0041c970
call fcn.00455060
push ecx
mov ecx, esp
push str.QQPCMgr.QQPCSafebox
call fcn.0041c970
call fcn.00455060
push ecx
mov ecx, esp
push str.PCMgrRepairIEExtensions
call fcn.0041c970
call fcn.00455060
push str.QQPCMgr.exe
mov edx, esi
lea ecx, [ebp - 0x60]
call fcn.0041c010
add esp, 4
mov byte [ebp - 4], 3
push dword [eax]
sub esp, 8
call fcn.00455120
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov edx, dword [ebp - 0x60]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x454293
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [esi]
lea ecx, [ebp - 0x40]
call fcn.00438600
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x58]
call fcn.004558a0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4542c6
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00433600
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.00455e70
test eax, eax
je 0x4542eb
lea ecx, [ebp - 0x58]
call fcn.004559f0
mov eax, dword [ebp - 0x44]
cmp eax, 8
jb 0x454300
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.00433600
xor eax, eax
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], 0
cmp eax, 8
jb 0x454329
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00433600
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x18], 0
test eax, eax
je 0x454347
push eax
call edi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a578d
mov esp, ebp
pop ebp
ret