Function at 0x4b2d50
Capabilities:
Delete registry value
Link many functions at runtime
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a8205
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x639354]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
push eax
push 0x2001f
push ebx
push 0x5b8734
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4b2e64
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x30]
push str..uof
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ebx
call fcn.0043a090
push str..uop
lea ecx, [ebp - 0x30]
call fcn.0043a090
push str..uos
lea ecx, [ebp - 0x30]
call fcn.0043a090
push str..uot
lea ecx, [ebp - 0x30]
call fcn.0043a090
push str.ksotheme
lea ecx, [ebp - 0x30]
call fcn.0043a090
push str.WPSSkin.WPSSkinAddin
lea ecx, [ebp - 0x30]
call fcn.0043a090
push 0x5bbe60
lea ecx, [ebp - 0x30]
call fcn.0043a090
push str.Wps_auto_file
lea ecx, [ebp - 0x30]
call fcn.0043a090
push str.Wpsdoc.wpsdoc
lea ecx, [ebp - 0x30]
call fcn.0043a090
push str.Et_auto_file
lea ecx, [ebp - 0x30]
call fcn.0043a090
push str.Uof_auto_file
lea ecx, [ebp - 0x30]
call fcn.0043a090
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4b2e5a
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], 0
test ebx, ebx
je 0x4b2ec5
cmp dword [ebx], 0
je 0x4b2eb8
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4b2f23
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b2ebe
push 0
push dword [ebx]
lea ecx, [ebp - 0x14]
push ecx
push 0x2001f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000001
call eax
jmp 0x4b2ee1
cmp dword [ebx + 4], 0
jne 0x4b2ec5
mov eax, 1
jmp 0x4b2ee1
lea eax, [ebp - 0x14]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x2001f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000001
call eax
test eax, eax
jne 0x4b2f23
test edi, edi
je 0x4b2eec
push edi
call esi
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b2f23
push 0x5bbef8
lea ecx, [ebp - 0x30]
call fcn.0043a090
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4b2f19
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
xor esi, esi
mov byte [ebp - 4], 3
mov dword [ebp - 0x10], esi
test ebx, ebx
je 0x4b2f8c
cmp dword [ebx], esi
je 0x4b2f80
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b3077
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b2f76
push 0
push dword [ebx]
lea ecx, [ebp - 0x10]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0Common
push 0x80000001
call eax
jmp 0x4b2fa7
mov esi, dword [ebp - 0x10]
mov eax, 1
jmp 0x4b2faa
cmp dword [ebx + 4], esi
jne 0x4b2f8c
mov eax, 1
jmp 0x4b2faa
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0Common
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x4b3071
test edi, edi
je 0x4b2fc0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x2c], 0
mov edi, esi
mov dword [ebp - 0x30], edi
test eax, eax
jne 0x4b3071
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.Version
push esi
call ebx
push str.PersonalVersionNumber
push esi
call ebx
push str.ProfessionVersionNumber
push esi
call ebx
push str.InstallRoot
push esi
call ebx
push str.DisplayName
push esi
call ebx
push str.DistSrc
push esi
call ebx
push str.DefaultLanguage
push esi
call ebx
push str.hostprocname
push esi
call ebx
push str.category
push esi
call ebx
push str.newGuideShow
push esi
call ebx
push str.Architecture
push esi
call ebx
push str.InstallPartialData
push esi
call ebx
push str.Theme
lea ecx, [ebp - 0x30]
call fcn.0043a090
push str.plgpf
lea ecx, [ebp - 0x30]
call fcn.0043a090
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4b3067
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov byte [ebp - 4], 4
mov dword [ebp - 0x18], 0
test ebx, ebx
je 0x4b30d4
cmp dword [ebx], 0
je 0x4b30c7
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b3130
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b30cd
push 0
push dword [ebx]
lea ecx, [ebp - 0x18]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
push 0x80000001
call eax
jmp 0x4b30ef
cmp dword [ebx + 4], 0
jne 0x4b30d4
mov eax, 1
jmp 0x4b30ef
lea eax, [ebp - 0x18]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b3130
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4b3100
push edi
call esi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b3130
push str.qald
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4b3129
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 5
mov dword [ebp - 0x1c], 0
test ebx, ebx
je 0x4b3191
cmp dword [ebx], 0
je 0x4b3184
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4b31f4
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b318a
push 0
push dword [ebx]
lea ecx, [ebp - 0x1c]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0Commonupdateinfo
push 0x80000001
call eax
jmp 0x4b31ac
cmp dword [ebx + 4], 0
jne 0x4b3191
mov eax, 1
jmp 0x4b31ac
lea eax, [ebp - 0x1c]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0Commonupdateinfo
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b31f4
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4b31bd
push edi
call esi
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b31f4
push str.cacheStatusInfo
lea ecx, [ebp - 0x30]
call fcn.0043a090
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4b31ea
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov esi, dword [str.SoftwarekingsoftOffice6.0Commonupdateinfo]
mov byte [ebp - 4], 6
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4b3257
cmp dword [ebx], 0
je 0x4b324a
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4b32af
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b3250
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push esi
push 0x80000001
call eax
jmp 0x4b326e
cmp dword [ebx + 4], 0
jne 0x4b3257
mov eax, 1
jmp 0x4b326e
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b32af
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4b327f
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b32af
push str.diffcheckerror
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4b32a8
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 7
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4b3312
cmp dword [ebx], 0
je 0x4b3305
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b3374
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b330b
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0etApplication_Settings
push 0x80000001
call eax
jmp 0x4b332d
cmp dword [ebx + 4], 0
jne 0x4b3312
mov eax, 1
jmp 0x4b332d
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0etApplication_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b336e
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4b333e
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b336e
push str.RestartAppInfo
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4b3367
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov byte [ebp - 4], 8
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4b33d1
cmp dword [ebx], 0
je 0x4b33c4
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b342d
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b33ca
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wpsApplication_Settings
push 0x80000001
call eax
jmp 0x4b33ec
cmp dword [ebx + 4], 0
jne 0x4b33d1
mov eax, 1
jmp 0x4b33ec
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wpsApplication_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b342d
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4b33fd
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b342d
push str.RestartAppInfo
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4b3426
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 9
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4b3490
cmp dword [ebx], 0
je 0x4b3483
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b34f2
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b3489
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wppApplication_Settings
push 0x80000001
call eax
jmp 0x4b34ab
cmp dword [ebx + 4], 0
jne 0x4b3490
mov eax, 1
jmp 0x4b34ab
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wppApplication_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b34ec
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4b34bc
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b34ec
push str.RestartAppInfo
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4b34e5
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4b354f
cmp dword [ebx], 0
je 0x4b3542
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b35ab
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b3548
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wpsofficeApplication_Settings
push 0x80000001
call eax
jmp 0x4b356a
cmp dword [ebx + 4], 0
jne 0x4b354f
mov eax, 1
jmp 0x4b356a
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wpsofficeApplication_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b35ab
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4b357b
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b35ab
push str.AppComponentMode
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4b35a4
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4b360e
cmp dword [ebx], 0
je 0x4b3601
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b3684
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b3607
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0pluginskstartpage
push 0x80000001
call eax
jmp 0x4b3629
cmp dword [ebx + 4], 0
jne 0x4b360e
mov eax, 1
jmp 0x4b3629
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0pluginskstartpage
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b367e
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4b363a
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b367e
push str.searchRecord
lea ecx, [ebp - 0x30]
call fcn.0043a090
push str.searchRecord2
lea ecx, [ebp - 0x30]
call fcn.0043a090
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4b3674
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4b36e1
cmp dword [ebx], 0
je 0x4b36d4
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b3751
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b36da
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOfficeclientInfo
push 0x80000001
call eax
jmp 0x4b36fc
cmp dword [ebx + 4], 0
jne 0x4b36e1
mov eax, 1
jmp 0x4b36fc
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOfficeclientInfo
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b3751
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4b370d
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b3751
push 0x5c5b78
lea ecx, [ebp - 0x30]
call fcn.0043a090
push str.installInfo
lea ecx, [ebp - 0x30]
call fcn.0043a090
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4b3747
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4b37b5
cmp dword [ebx], 0
je 0x4b37a8
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4b377b
mov eax, 1
jmp 0x4b37ec
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b37ae
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.Environment
push 0x80000001
call eax
jmp 0x4b37d0
cmp dword [ebx + 4], 0
jne 0x4b37b5
mov eax, 1
jmp 0x4b37d0
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.Environment
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b37ec
test edi, edi
je 0x4b37df
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 0
test eax, eax
jne 0x4b39c8
mov byte [ebp - 4], 0xe
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47bd
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
push str.WPS_HOME
push edi
mov byte [ebp - 4], 0xf
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x208
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push str.PATH
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b3995
mov eax, dword [ebp - 0x20]
cmp eax, 1
je 0x4b385e
cmp eax, 2
jne 0x4b3995
mov eax, dword [ebp - 0x24]
shr eax, 1
mov dword [ebp - 0x24], eax
je 0x4b3995
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0055c532
mov ecx, dword [ebp - 0x24]
add esp, 4
mov esi, eax
add ecx, ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ecx
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push 0
push str.PATH
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b397a
mov eax, dword [ebp - 0x20]
cmp eax, 1
je 0x4b38c2
cmp eax, 2
jne 0x4b397a
test esi, esi
je 0x4b3982
cmp dword [ebp - 0x24], 0
jne 0x4b38d5
xor eax, eax
mov word [esi], ax
mov ecx, esi
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b38e0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x10]
call fcn.004299d0
push esi
call fcn.0055c53b
add esp, 4
lea ecx, [ebp - 0x10]
push 0x5b8734
push str._WPS_HOME__
call fcn.00463440
push 0x5b8734
push str.__WPS_HOME_
lea ecx, [ebp - 0x10]
call fcn.00463440
push 0x5b8734
push str._WPS_HOME_
lea ecx, [ebp - 0x10]
call fcn.00463440
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x4b3989
test esi, esi
je 0x4b3995
mov ecx, esi
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b3950
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 2
push 0
push str.PATH
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4b3995
test esi, esi
jne 0x4b38d5
xor ecx, ecx
jmp 0x4b38ef
push str.PATH
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4b39a5
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4b39c8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp + 8], 0
jne 0x4b47a0
lea ecx, [ebp - 0x3c]
call fcn.004d1b40
push 0x104
push ecx
mov esi, esp
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.infoGUID
mov byte [ebp - 4], 0x11
mov ecx, esi
test eax, 0xffff0000
jne 0x4b3a22
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b3a2e
push 8
push str.infoGUID
call fcn.0042a060
push ecx
mov esi, esp
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47c7
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0Common
mov byte [ebp - 4], 0x13
shr eax, 0x10
mov ecx, str.SoftwareKingsoftOffice6.0Common
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4b3a76
movzx eax, cx
mov ecx, esi
push eax
call fcn.00429d90
jmp 0x4b3a84
push 0x23
push str.SoftwareKingsoftOffice6.0Common
mov ecx, esi
call fcn.0042a060
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1ec0
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.savedump
mov byte [ebp - 4], 0x14
mov ecx, esi
test eax, 0xffff0000
jne 0x4b3add
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b3ae9
push 8
push str.savedump
call fcn.0042a060
push ecx
mov esi, esp
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47d1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0x16
jne 0x4b3b28
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b3b34
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.0042a060
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1ec0
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.fulldump
mov byte [ebp - 4], 0x17
mov ecx, esi
test eax, 0xffff0000
jne 0x4b3b8d
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b3b99
push 8
push str.fulldump
call fcn.0042a060
push ecx
mov esi, esp
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47db
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0x19
jne 0x4b3bd8
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b3be4
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.0042a060
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1ec0
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.wpsiu
mov byte [ebp - 4], 0x1a
mov ecx, esi
test eax, 0xffff0000
jne 0x4b3c3d
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b3c49
push 5
push str.wpsiu
call fcn.0042a060
push ecx
mov esi, esp
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47e5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0x1c
jne 0x4b3c88
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b3c94
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.0042a060
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1ec0
push 0x800
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.Pushed
mov byte [ebp - 4], 0x1d
mov ecx, esi
test eax, 0xffff0000
jne 0x4b3ced
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b3cf9
push 6
push str.Pushed
call fcn.0042a060
push ecx
mov esi, esp
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47ef
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0x1f
jne 0x4b3d38
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b3d44
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.0042a060
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1ec0
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x24], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, 0x5bc268
mov byte [ebp - 4], 0x20
mov ecx, esi
test eax, 0xffff0000
jne 0x4b3d9d
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b3da9
push 3
push 0x5bc268
call fcn.0042a060
push ecx
mov esi, esp
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x1c], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47f9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0CommonAuthInfo
mov byte [ebp - 4], 0x22
shr eax, 0x10
mov ecx, str.SoftwareKingsoftOffice6.0CommonAuthInfo
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x4b3df1
movzx eax, cx
mov ecx, esi
push eax
call fcn.00429d90
jmp 0x4b3dff
push 0x2c
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
mov ecx, esi
call fcn.0042a060
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1ec0
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x1c], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.fldLength
mov byte [ebp - 4], 0x23
mov ecx, esi
test eax, 0xffff0000
jne 0x4b3e58
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b3e64
push 9
push str.fldLength
call fcn.0042a060
push ecx
mov esi, esp
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x1c], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b4803
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x24], 0
mov ecx, esi
mov byte [ebp - 4], 0x25
jne 0x4b3ea3
mov eax, str.SoftwareKingsoftOffice6.0CommonAuthInfo
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b3eaf
push 0x2c
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
call fcn.0042a060
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1ec0
push 0
push ecx
mov esi, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x1c], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.snld
mov byte [ebp - 4], 0x26
mov ecx, esi
test eax, 0xffff0000
jne 0x4b3f05
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b3f11
push 4
push str.snld
call fcn.0042a060
push ecx
mov esi, esp
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x1c], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b480d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x24], 0
mov ecx, esi
mov byte [ebp - 4], 0x28
jne 0x4b3f50
mov eax, str.SoftwareKingsoftOffice6.0CommonAuthInfo
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b3f5c
push 0x2c
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
call fcn.0042a060
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1ec0
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.enable
mov byte [ebp - 4], 0x29
mov ecx, esi
test eax, 0xffff0000
jne 0x4b3fb5
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b3fc1
push 6
push str.enable
call fcn.0042a060
push ecx
mov esi, esp
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b4817
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0Commonhookdnsnew
mov byte [ebp - 4], 0x2b
mov ecx, esi
test eax, 0xffff0000
jne 0x4b4001
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b400d
push 0x2e
push str.SoftwareKingsoftOffice6.0Commonhookdnsnew
call fcn.0042a060
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1ec0
push 0xffffffffffffffff
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.wps_t
mov byte [ebp - 4], 0x2c
mov ecx, esi
test eax, 0xffff0000
jne 0x4b4063
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b406f
push 5
push str.wps_t
call fcn.0042a060
push ecx
mov esi, esp
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b4821
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0wps
mov byte [ebp - 4], 0x2e
mov ecx, esi
test eax, 0xffff0000
jne 0x4b40af
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b40bb
push 0x20
push str.SoftwareKingsoftOffice6.0wps
call fcn.0042a060
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1d40
push 0xffffffffffffffff
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.et_t
mov byte [ebp - 4], 0x2f
mov ecx, esi
test eax, 0xffff0000
jne 0x4b4111
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b411d
push 4
push str.et_t
call fcn.0042a060
push ecx
mov esi, esp
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b482b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0et
mov byte [ebp - 4], 0x31
mov ecx, esi
test eax, 0xffff0000
jne 0x4b415d
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b4169
push 0x1f
push str.SoftwareKingsoftOffice6.0et
call fcn.0042a060
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1d40
push 0xffffffffffffffff
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.wpp_t
mov byte [ebp - 4], 0x32
mov ecx, esi
test eax, 0xffff0000
jne 0x4b41bf
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b41cb
push 5
push str.wpp_t
call fcn.0042a060
push ecx
mov esi, esp
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b4835
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0wpp
mov byte [ebp - 4], 0x34
mov ecx, esi
test eax, 0xffff0000
jne 0x4b420b
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b4217
push 0x20
push str.SoftwareKingsoftOffice6.0wpp
call fcn.0042a060
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1d40
push 0
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.PromeWindowCount
mov byte [ebp - 4], 0x35
mov ecx, esi
test eax, 0xffff0000
jne 0x4b426d
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b4279
push 0x10
push str.PromeWindowCount
call fcn.0042a060
push ecx
mov esi, esp
mov byte [ebp - 4], 0x36
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b483f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0x37
jne 0x4b42b8
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b42c4
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.0042a060
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1d40
push 0
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.WindowCount
mov byte [ebp - 4], 0x38
mov ecx, esi
test eax, 0xffff0000
jne 0x4b431a
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b4326
push 0xb
push str.WindowCount
call fcn.0042a060
push ecx
mov esi, esp
mov byte [ebp - 4], 0x39
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b4849
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0x3a
jne 0x4b4365
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b4371
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.0042a060
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1d40
push 0
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b47bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.DcWindowCount
mov byte [ebp - 4], 0x3b
mov ecx, esi
test eax, 0xffff0000
jne 0x4b43c7
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b43d3
push 0xd
push str.DcWindowCount
call fcn.0042a060
push ecx
mov esi, esp
mov byte [ebp - 4], 0x3c
mov dword [ebp - 0x20], esi
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4b4853
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0x3d
jne 0x4b4412
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4b441e
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.0042a060
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1d40
xor esi, esi
mov byte [ebp - 4], 0x3e
mov dword [ebp - 0x10], esi
test ebx, ebx
je 0x4b449c
cmp dword [ebx], esi
je 0x4b4490
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b451d
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b4486
push 0
push dword [ebx]
lea ecx, [ebp - 0x10]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0CommonUserInfo
push 0x80000001
call eax
jmp 0x4b44b7
mov esi, dword [ebp - 0x10]
mov eax, 1
jmp 0x4b44ba
cmp dword [ebx + 4], esi
jne 0x4b449c
mov eax, 1
jmp 0x4b44ba
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0CommonUserInfo
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x4b4517
test edi, edi
je 0x4b44cc
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x2c], 0
mov edi, esi
mov dword [ebp - 0x30], edi
test eax, eax
jne 0x4b4517
push str.WhatNewLastCheckDate
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.WhatNewLastCheckFlag
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.WhatNewVersion
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x4b4510
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov byte [ebp - 4], 0x3f
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4b457d
cmp dword [ebx], 0
je 0x4b4570
push str.Advapi32.dll
call esi
test eax, eax
jne 0x4b4543
mov eax, 1
jmp 0x4b45b4
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b4576
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOffice
push 0x80000001
call eax
jmp 0x4b4598
cmp dword [ebx + 4], 0
jne 0x4b457d
mov eax, 1
jmp 0x4b4598
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOffice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b45b4
test edi, edi
je 0x4b45a7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 0x10
test eax, eax
jne 0x4b4607
mov ecx, 0x641e28
call fcn.00496c50
test eax, eax
setne bl
test eax, eax
je 0x4b45d4
call fcn.00542790
push 0x5bbef0
lea ecx, [ebp - 0x30]
call fcn.0043a090
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4b45f4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test bl, bl
je 0x4b4604
call fcn.0053cf40
mov ebx, dword [ebp - 0x28]
xor esi, esi
mov byte [ebp - 4], 0x40
mov dword [ebp - 0x10], esi
test ebx, ebx
je 0x4b4670
cmp dword [ebx], esi
je 0x4b4664
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b46e5
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b465a
push 0
push dword [ebx]
lea ecx, [ebp - 0x10]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOffice
push 0x80000001
call eax
jmp 0x4b468b
mov esi, dword [ebp - 0x10]
mov eax, 1
jmp 0x4b468e
cmp dword [ebx + 4], esi
jne 0x4b4670
mov eax, 1
jmp 0x4b468e
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOffice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x4b46df
test edi, edi
je 0x4b46a0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x2c], 0
mov edi, esi
mov dword [ebp - 0x30], edi
test eax, eax
jne 0x4b46df
push 0x5bc304
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.mui_file_list
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x4b46d8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov byte [ebp - 4], 0x41
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4b4742
cmp dword [ebx], 0
je 0x4b4735
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b4798
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b473b
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOfficeWPS
push 0x80000001
call eax
jmp 0x4b475d
cmp dword [ebx + 4], 0
jne 0x4b4742
mov eax, 1
jmp 0x4b475d
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOfficeWPS
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b4798
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4b476e
push edi
call ebx
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b4798
push str.AddinsLF
lea ecx, [ebp - 0x30]
call fcn.0043a090
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4b4798
push edi
call ebx
xor edi, edi
lea ecx, [ebp - 0x3c]
call fcn.004d1c30
test edi, edi
je 0x4b47ab
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
int3