Function at 0x454150
Capabilities:
Check if file exists
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7240
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebx + 0xc]
call fcn.004404e0
test eax, eax
jne 0x454577
mov dword [ebp - 0x5c], eax
mov dword [ebp - 4], eax
lea esi, [ebx + 4]
mov edx, dword [esi]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
cmp word [edx], ax
jne 0x4541af
xor ecx, ecx
jmp 0x4541c3
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4541b4
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00439160
push str.npQMExtensionsMozilla.dll
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0048eea0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4542c2
call fcn.0048a560
test eax, eax
mov eax, dword [ebp - 0x5c]
jne 0x45422b
test eax, eax
je 0x454211
push eax
call edi
push 0
lea eax, [ebp - 0x5c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMozillaPlugins_qq.com_QQPCMgr
jmp 0x45424a
test eax, eax
je 0x454232
push eax
call edi
push 0
lea eax, [ebp - 0x5c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREWow6432NodeMozillaPlugins_qq.com_QQPCMgr
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x5c], 0
call eax
test eax, eax
jne 0x4542c2
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x5c]
cmovae eax, dword [ebp - 0x28]
push eax
push str.Path
call fcn.00440870
push str.QQPCMgr_Detector
push str.Description
lea ecx, [ebp - 0x5c]
call fcn.00440870
push str.QQPCMgr_Detector
push 0x4f3c60
lea ecx, [ebp - 0x5c]
call fcn.00440870
push 0x4f3c78
push str.Vendor
lea ecx, [ebp - 0x5c]
call fcn.00440870
push str.2.0.0.2
push str.Version
lea ecx, [ebp - 0x5c]
call fcn.00440870
mov edx, dword [esi]
cmp word [edx], 0
jne 0x4542ce
xor ecx, ecx
jmp 0x4542e6
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x64], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4542d6
sub ecx, dword [ebp - 0x64]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00439160
push str.QQPCClinic.exe
lea ecx, [ebp - 0x28]
call fcn.0048eea0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4543d7
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicy_
lea ecx, [ebp - 0x64]
call fcn.0041c970
push 0x26
push str.16EE6530_8649_4F42_A9E4_F6A3295AF975
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.0041c490
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x454347
push eax
call edi
push 0
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp - 0x60]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4543b8
push dword [esi]
lea ecx, [ebp - 0x5c]
push str.AppPath
call fcn.00440870
push str.QQPCClinic.exe
push str.AppName
lea ecx, [ebp - 0x5c]
call fcn.00440870
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], 3
test eax, eax
je 0x4543b8
push 4
lea ecx, [ebp - 0x60]
push ecx
push 4
push 0
push str.Policy
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov edx, dword [ebp - 0x64]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4543d7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.Set_Relation_File_Type
push 0x515488
call fcn.0048d4b0
add esp, 8
cmp dword [0x515428], 0
je 0x454425
push str.IsConvertInstall_TRUE
push 0x515488
call fcn.0048d4b0
add esp, 8
cmp dword [ebx + 0x48], 0
jne 0x454411
push str.m_bFileOpenWasSet_TRUE
jmp 0x45442a
push str.m_bFileOpenWasSet_FALSE
push 0x515488
call fcn.0048d4b0
add esp, 8
jmp 0x45443d
push str.IsConvertInstall_FALSE
push 0x515488
call fcn.0048d4b0
add esp, 8
push esi
call fcn.00454da0
push str.Reload_WebClinic
push 0x515488
call fcn.0048d4b0
add esp, 4
mov ecx, esp
push str.QQPCMgr.WebGame
call fcn.0041c970
call fcn.00455290
push ecx
mov ecx, esp
push str.QQPCMgr.QQPCSafebox
call fcn.0041c970
call fcn.00455290
push ecx
mov ecx, esp
push str.PCMgrRepairIEExtensions
call fcn.0041c970
call fcn.00455290
push str.QQPCMgr.exe
mov edx, esi
lea ecx, [ebp - 0x60]
call fcn.0041c010
add esp, 4
mov byte [ebp - 4], 3
push dword [eax]
sub esp, 8
call fcn.00455350
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov edx, dword [ebp - 0x60]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4544c3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [esi]
lea ecx, [ebp - 0x40]
call fcn.00438600
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x58]
call fcn.00455ad0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4544f6
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00433600
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.004560b0
test eax, eax
je 0x45451b
lea ecx, [ebp - 0x58]
call fcn.00455c20
mov eax, dword [ebp - 0x44]
cmp eax, 8
jb 0x454530
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.00433600
xor eax, eax
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], 0
cmp eax, 8
jb 0x454559
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00433600
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x18], 0
test eax, eax
je 0x454577
push eax
call edi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret