Function at 0x43bb60
Capabilities:
Delete registry value
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov word [ebp - 0x838], 0
push 0x206
push 0
lea eax, [ebp - 0x836]
push eax
call fcn.00415680
add esp, 0xc
mov dword [ebp - 0x83c], 0x104
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x424]
push ecx
push 0x20019
push 0
push 0x46ff9c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43bbcf
mov eax, 1
jmp 0x43be28
mov dword [ebp - 0x83c], 0x104
lea edx, [ebp - 0x83c]
push edx
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0x46ffcc
mov edx, dword [ebp - 0x424]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x43bc1a
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x43be28
mov dword [ebp - 0x83c], 0x104
lea ecx, [ebp - 0x83c]
push ecx
lea edx, [ebp - 0x838]
push edx
push 0
push 0
push 0x46ffdc
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x43bc63
mov ecx, dword [ebp - 0x424]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x43be28
push str.1.5.255.255
lea edx, [ebp - 0x838]
push edx
call fcn.004383a0
add esp, 8
test eax, eax
jle 0x43bc92
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x43be28
lea ecx, [ebp - 0x838]
push ecx
call fcn.00414d31
add esp, 4
test eax, eax
jbe 0x43bcc8
lea edx, [ebp - 0x838]
push edx
push 0x470004
push 0x208
push 0x104
push 0x4888f0
call fcn.004157ac
add esp, 0x14
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x420]
push ecx
call fcn.00438d00
add esp, 4
push 0x47000c
push connect
call fcn.00439800
add esp, 8
push 0x47001c
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00439800
add esp, 8
lea edx, [ebp - 0x424]
push edx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43bd3c
push 0x4700d4
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallQQ2009
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00439800
add esp, 8
mov word [ebp - 0x218], 0
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.00415680
add esp, 0xc
mov dword [ebp - 8], 0
lea edx, [ebp - 8]
push edx
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0x630]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea edx, [ebp - 0x630]
push edx
push str._sTencentQQAUTemp
push 0x208
push 0x104
lea eax, [ebp - 0x630]
push eax
call fcn.004157ac
add esp, 0x14
lea ecx, [ebp - 0x630]
push ecx
call fcn.00438d00
add esp, 4
push 0x470160
push 0x470178
push 0x470198
call fcn.004396d0
add esp, 0xc
push 0x4701b4
push 0x4701cc
push 0x4701ec
call fcn.004396d0
add esp, 0xc
push str.CN_vAx0x_
push 0x470220
push 0x470240
call fcn.004396d0
add esp, 0xc
push str.Tencent_SoftwareQQ2009
push str.Uninstall_Tencent_QQ2009.lnk
push str.Tencent_QQ2009.lnk
call fcn.004396d0
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret