Function at 0x491c30
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Delete registry value
Get common file path
Parse pe header
Persist via run registry key
Persist via screensaver registry key
Print debug messages
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a5464
mov eax, dword fs:[0]
push eax
sub esp, 0x848
mov eax, dword [0x639354]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x720], ebx
xor eax, eax
mov dword [ebp - 0x734], eax
mov dword [ebp - 0x74c], eax
call fcn.0049c8e0
push str.372_tKUninstall::ExecuteBeforeDeleteFiles_tExecute_before_delete_files_...
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
lea eax, [ebx + 0x10]
push eax
mov dword [ebp - 0x724], eax
call fcn.00480b50
add esp, 0x14
mov ecx, ebx
call fcn.0049dd60
mov eax, dword [ebx + 0x84]
xor ecx, ecx
mov edx, dword [ebx + 0x88]
mov dword [ebp - 0x7ac], edx
mov esi, dword [eax]
mov dword [ebp - 0x738], esi
cmp esi, eax
je 0x494a16
mov edi, dword [ebp - 0x7c4]
inc ecx
push edx
mov dword [ebp - 0x7a8], ecx
push ecx
mov ecx, 0x6420c8
call fcn.004bf710
mov ecx, dword [ebp - 0x720]
mov eax, dword [ecx + 0x54]
test eax, eax
je 0x491d0f
push dword [ecx + 0x28]
push dword [ebp - 0x7ac]
push dword [ebp - 0x7a8]
call eax
mov ecx, dword [ebp - 0x720]
add esp, 0xc
cmp dword [ecx + 0xdc], 0
je 0x491d2b
cmp dword [ecx + 0xe0], 0
mov dword [ebp - 0x758], 1
jne 0x491d35
mov dword [ebp - 0x758], 0
mov ebx, dword [esi + 8]
lea eax, [ebx + 4]
push str._sendinstalldyn
push dword [eax]
mov dword [ebp - 0x72c], eax
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x4924d7
push str.office6ksomisc.exe
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x4924d7
call fcn.00441be0
test eax, eax
je 0x491ded
push 0
lea eax, [ebp - 0x804]
push str.InfoCollect
push eax
call fcn.00460d50
mov ecx, dword [ebp - 0x734]
add esp, 0xc
or ecx, 1
mov dword [ebp - 0x734], ecx
mov dword [ebp - 0x74c], ecx
mov eax, dword [eax]
mov ecx, 0x5b9868
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x491dd6
test dx, dx
je 0x491dd2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x491dd6
add eax, 4
add ecx, 4
test dx, dx
jne 0x491db0
xor eax, eax
jmp 0x491ddb
sbb eax, eax
or eax, 1
mov dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x719], 1
test eax, eax
je 0x491df4
mov byte [ebp - 0x719], 0
mov eax, dword [ebp - 0x734]
test al, 1
je 0x491e2b
mov edx, dword [ebp - 0x804]
and eax, 0xfffffffe
mov dword [ebp - 0x734], eax
add edx, 0xfffffff0
mov dword [ebp - 0x74c], eax
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x491e2b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x719], 0
jne 0x4949ef
mov eax, dword [ebp - 0x720]
mov esi, 0x5bbd7c
cmp dword [eax + 4], 0
mov eax, 0x5b9868
cmove esi, eax
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x494a51
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x72c], eax
mov dword [ebp - 4], 1
test esi, 0xffff0000
jne 0x491e8c
movzx eax, si
lea ecx, [ebp - 0x72c]
push eax
call fcn.00429d90
jmp 0x491ead
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x491e91
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x72c]
call fcn.0042a060
mov dword [ebp - 4], 2
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x494a51
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x73c], eax
mov eax, str.info_mode
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x73c]
test eax, 0xffff0000
jne 0x491ef2
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x491efe
push 9
push str.info_mode
call fcn.0042a060
mov byte [ebp - 4], 4
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x494a51
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x748], eax
mov eax, 0x5c3704
mov byte [ebp - 4], 5
shr eax, 0x10
lea ecx, [ebp - 0x748]
mov dword [ebp - 0x780], eax
test eax, eax
jne 0x491f4b
mov eax, 0x5c3704
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x491f57
push 6
push 0x5c3704
call fcn.0042a060
mov esi, dword [str.SOFTWAREKingsoftOffice6.0Uninstall]
mov byte [ebp - 4], 6
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x494a51
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x744], eax
mov byte [ebp - 4], 7
test esi, esi
je 0x491fb5
test esi, 0xffff0000
jne 0x491f9f
movzx eax, si
lea ecx, [ebp - 0x744]
push eax
call fcn.00429d90
jmp 0x491fc4
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x491fa4
sub ecx, edx
sar ecx, 1
jmp 0x491fb7
xor ecx, ecx
push ecx
push esi
lea ecx, [ebp - 0x744]
call fcn.0042a060
mov ecx, dword [ebp - 0x720]
lea eax, [ebp - 0x72c]
push 0
push eax
lea eax, [ebp - 0x73c]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x748]
push eax
lea eax, [ebp - 0x744]
push eax
call fcn.0049c760
mov edx, dword [ebp - 0x744]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49200f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x748]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49202d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x73c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49204b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x72c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x492070
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x720]
mov esi, 0x5bbd7c
cmp dword [eax + 0x20], 0
mov eax, 0x5b9868
cmove esi, eax
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x494a51
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x744], eax
mov dword [ebp - 4], 9
test esi, 0xffff0000
jne 0x4920c4
movzx eax, si
lea ecx, [ebp - 0x744]
push eax
call fcn.00429d90
jmp 0x4920ec
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4920d0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x744]
call fcn.0042a060
mov dword [ebp - 4], 0xa
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x494a51
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x748], eax
mov eax, str.info_savedata
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x748]
test eax, 0xffff0000
jne 0x492131
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x49213d
push 0xd
push str.info_savedata
call fcn.0042a060
mov byte [ebp - 4], 0xc
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x494a51
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x73c], eax
cmp dword [ebp - 0x780], 0
lea ecx, [ebp - 0x73c]
mov byte [ebp - 4], 0xd
jne 0x492181
mov eax, 0x5c3704
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x49218d
push 6
push 0x5c3704
call fcn.0042a060
mov esi, dword [str.SOFTWAREKingsoftOffice6.0Uninstall]
mov byte [ebp - 4], 0xe
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x494a51
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x72c], eax
mov byte [ebp - 4], 0xf
test esi, esi
je 0x4921f1
test esi, 0xffff0000
jne 0x4921d5
movzx eax, si
lea ecx, [ebp - 0x72c]
push eax
call fcn.00429d90
jmp 0x492200
mov ecx, esi
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4921e0
sub ecx, edx
sar ecx, 1
jmp 0x4921f3
xor ecx, ecx
push ecx
push esi
lea ecx, [ebp - 0x72c]
call fcn.0042a060
mov ecx, dword [ebp - 0x720]
lea eax, [ebp - 0x744]
push 0
push eax
lea eax, [ebp - 0x748]
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x73c]
push eax
lea eax, [ebp - 0x72c]
push eax
call fcn.0049c760
mov edx, dword [ebp - 0x72c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49224b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x73c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x492269
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x748]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x492287
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x744]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4922a5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0x11
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x494a51
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x72c], eax
push 4
lea eax, [ebp - 0x72c]
mov dword [ebp - 4], 0x12
push 0x5c3730
push eax
call fcn.0042c720
mov eax, dword [ebp - 0x72c]
lea esi, [ebx + 4]
add esp, 0xc
lea ecx, [eax - 0x10]
mov dword [ebp - 0x728], ecx
push dword [ecx + 4]
mov ecx, esi
push eax
call fcn.004299d0
mov byte [ebp - 4], 0x13
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x494a51
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x73c], eax
mov byte [ebp - 4], 0x15
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x494a51
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x748], eax
mov byte [ebp - 4], 0x17
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x494a51
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x744], eax
mov eax, dword [ebp - 0x720]
lea ecx, [ebp - 0x73c]
add eax, 0x10c
mov byte [ebp - 4], 0x18
push eax
call fcn.004297a0
mov eax, dword [ebp - 0x720]
lea ecx, [ebp - 0x748]
add eax, 0x110
push eax
call fcn.004297a0
mov eax, dword [ebp - 0x720]
lea ecx, [ebp - 0x744]
add eax, 0x114
push eax
call fcn.004297a0
push 1
push 0x5c1e54
mov ecx, esi
call fcn.004299d0
push 1
push 0x5bb918
mov ecx, esi
call fcn.004299d0
mov eax, dword [ebp - 0x73c]
push dword [eax - 0xc]
lea ecx, [eax - 0x10]
mov dword [ebp - 0x730], ecx
mov ecx, esi
push eax
call fcn.004299d0
push 1
push 0x5bb918
mov ecx, esi
call fcn.004299d0
push 1
push 0x5c1e54
mov ecx, esi
call fcn.004299d0
push 1
push 0x5bb918
mov ecx, esi
call fcn.004299d0
mov eax, dword [ebp - 0x748]
push dword [eax - 0xc]
lea ecx, [eax - 0x10]
mov dword [ebp - 0x750], ecx
mov ecx, esi
push eax
call fcn.004299d0
push 1
push 0x5bb918
mov ecx, esi
call fcn.004299d0
push 1
push 0x5c1e54
mov ecx, esi
call fcn.004299d0
push 1
push 0x5bb918
mov ecx, esi
call fcn.004299d0
mov eax, dword [ebp - 0x744]
push dword [eax - 0xc]
lea ecx, [eax - 0x10]
mov dword [ebp - 0x780], ecx
mov ecx, esi
push eax
call fcn.004299d0
push 1
push 0x5bb918
mov ecx, esi
call fcn.004299d0
mov edx, dword [ebp - 0x780]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x492496
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x750]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4924b1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x730]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4924cc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x728]
jmp 0x492878
push str.office6ksomisc.exe
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x4925e0
mov eax, dword [ebx + 4]
add eax, 0xfffffff0
cmp dword [eax + 4], 0x15
jg 0x49250b
push eax
call fcn.00429b80
add esp, 4
lea edi, [eax + 0x10]
jmp 0x4925af
mov ecx, dword [eax]
test ecx, ecx
je 0x492527
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
je 0x492527
mov eax, dword [ebx + 4]
mov dword [ebp - 0x73c], eax
jmp 0x492546
call fcn.00429250
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x73c], eax
test ecx, ecx
je 0x494a51
test eax, eax
je 0x494a60
mov eax, dword [ecx]
push 2
push 0x15
call dword [eax]
test eax, eax
je 0x494a5b
cmp dword [eax + 8], 0x15
lea edi, [eax + 0x10]
mov dword [ebp - 0x728], edi
jl 0x494a60
xor eax, eax
mov dword [edi - 0xc], 0x15
mov word [edi + 0x2a], ax
test edi, edi
jne 0x492594
call fcn.0056b02e
mov dword [eax], 0x16
call fcn.0056af54
jmp 0x4925af
mov esi, dword [ebp - 0x73c]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebp - 0x728]
mov esi, dword [ebp - 0x738]
mov eax, dword [ebp - 0x734]
or eax, 8
or eax, 2
push str._deletelink_startmenu
push edi
mov dword [ebp - 0x734], eax
mov dword [ebp - 0x74c], eax
call fcn.0056b422
add esp, 8
mov byte [ebp - 0x719], 1
test eax, eax
je 0x4925e7
mov byte [ebp - 0x719], 0
mov eax, dword [ebp - 0x734]
mov dword [ebp - 4], 0xffffffff
test al, 2
je 0x49261f
and eax, 0xfffffffd
lea edx, [edi - 0x10]
mov dword [ebp - 0x734], eax
mov dword [ebp - 0x74c], eax
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49261f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x719], 0
je 0x492899
cmp byte [0x6134f8], 0
je 0x4943c7
push str.433_tKUninstall::ExecuteBeforeDeleteFiles_tRead_Start_Menu_Directory_From_Windows_Registry_And_Delete_It.
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
mov byte [0x6134f8], 0
call fcn.0046b730
mov ecx, dword [ebp - 0x720]
lea eax, [ebp - 0x778]
add esp, 0x10
push eax
call fcn.00495c90
mov eax, dword [ebp - 0x778]
mov dword [ebp - 4], 0x1a
cmp dword [eax - 0xc], 0
je 0x492850
push eax
push str.437_tKUninstall::ExecuteBeforeDeleteFiles_tRead_Start_Menu_Directory_From_Windows_Registry_Successfully._Menu_Directory___ws
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov eax, dword [ebx + 4]
lea esi, [ebx + 4]
add esp, 0x14
cmp dword [eax - 0xc], 0
jl 0x49286f
push 0x5bb918
push eax
call fcn.00561570
add esp, 8
test eax, eax
je 0x49286f
sub eax, dword [esi]
sar eax, 1
cmp eax, 0xffffffff
je 0x49286f
push eax
lea eax, [ebp - 0x75c]
mov ecx, esi
push eax
call fcn.004487c0
push 1
push 0x5bb918
lea ecx, [ebp - 0x75c]
mov byte [ebp - 4], 0x1b
call fcn.004299d0
mov eax, dword [ebp - 0x778]
lea ecx, [ebp - 0x75c]
push dword [eax - 0xc]
push eax
call fcn.004299d0
push 1
push 0x5bb918
lea ecx, [ebp - 0x75c]
call fcn.004299d0
cmp dword [ebp - 0x758], 0
je 0x4927b1
mov eax, dword [ebp - 0x720]
cmp dword [eax + 0xe0], 0
je 0x4927b1
push dword [esi]
push dword [ebx]
push str.448_tKUninstall::ExecuteBeforeDeleteFiles_tSendMsgToRunProcess:_ws__params_ws
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov esi, dword [ebp - 0x75c]
add esp, 0x18
push dword [ebx + 0xc]
lea eax, [esi - 0x10]
push dword [ebx + 8]
push ecx
mov dword [ebp - 0x728], esp
mov dword [ebp - 0x838], esp
push eax
call fcn.00429b80
mov ecx, dword [ebp - 0x838]
add eax, 0x10
mov dword [ecx], eax
mov eax, esp
mov byte [ebp - 4], 0x1c
push ebx
push dword [ebp - 0x724]
push eax
call fcn.0042afa0
mov ecx, dword [ebp - 0x720]
add esp, 0xc
mov byte [ebp - 4], 0x1b
call fcn.0049c0e0
jmp 0x49282d
push dword [esi]
push dword [ebx]
push str.453_tKUninstall::ExecuteBeforeDeleteFiles_tRunApp:_ws__params_ws
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
push ebx
push dword [ebp - 0x724]
mov dword [ebp - 0x728], eax
lea eax, [ebp - 0x83c]
push eax
call fcn.0042afa0
push 0
push 1
push 0
push esi
push dword [ebp - 0x728]
mov esi, dword [ebp - 0x75c]
push esi
push dword [eax]
mov byte [ebp - 4], 0x1d
call fcn.0047fdb0
mov edx, dword [ebp - 0x83c]
add esp, 0x40
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49282d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x492845
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x778]
jmp 0x4949ca
push str.460_tKUninstall::ExecuteBeforeDeleteFiles_tFailed_to_Read_Start_Menu_Directory_From_Windows_Registry.
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
add esp, 0x10
lea esi, [ebx + 4]
mov edx, dword [ebp - 0x778]
add edx, 0xfffffff0
or eax, 0xffffffff
mov dword [ebp - 4], eax
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4943ca
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4943ca
push str.killproc
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x4928de
mov ebx, dword [ebp - 0x72c]
push dword [ebx]
push str.467_tKUninstall::ExecuteBeforeDeleteFiles_tKill_Process:_ws
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
push 1
push dword [ebx]
call fcn.00481010
add esp, 0x1c
jmp 0x4949ef
push str.StopPluginHost
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x492a45
mov ecx, dword [ebp - 0x72c]
push dword [ecx]
push str.475_tKUninstall::ExecuteBeforeDeleteFiles_tStopping_wpscloudsvr:_ws
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
add esp, 0x14
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x494a51
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x774], eax
mov eax, str.wpscloudsvr
mov dword [ebp - 4], 0x1e
shr eax, 0x10
mov ecx, str.wpscloudsvr
movzx ebx, cx
lea ecx, [ebp - 0x774]
mov dword [ebp - 0x728], eax
test eax, eax
jne 0x492965
push ebx
call fcn.00429d90
jmp 0x492971
push 0xb
push str.wpscloudsvr
call fcn.0042a060
lea eax, [ebp - 0x774]
mov dword [ebp - 4], 0x1f
push eax
call fcn.00480a90
mov edx, dword [ebp - 0x774]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4929ac
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x724]
call fcn.00480b50
add esp, 4
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x494a51
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0x728], 0
lea ecx, [ebp - 0x770]
mov dword [ebp - 4], 0x20
jne 0x4929f5
push ebx
call fcn.00429d90
jmp 0x492a01
push 0xb
push str.wpscloudsvr
call fcn.0042a060
lea eax, [ebp - 0x770]
mov dword [ebp - 4], 0x21
push eax
call fcn.00480a90
mov edx, dword [ebp - 0x770]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4949ef
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4949ef
push str.regsvr32
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x492b03
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00560a80
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.System32_regsvr32.exe
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0056f877
mov ebx, dword [ebp - 0x72c]
push dword [ebx]
push str.488_tKUninstall::ExecuteBeforeDeleteFiles_tRegsvr32:_ws
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
add esp, 0x20
lea ecx, [ebp - 0x840]
push 2
call fcn.00527490
push 1
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebx]
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0x22
push eax
call fcn.0047fdb0
add esp, 0x1c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x840]
call fcn.00527530
jmp 0x4949ef
lea ecx, [ebx + 4]
push str._unregmtfont
push dword [ecx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x492bb4
push str.office6ksomisc.exe
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x492bb4
push dword [ebx + 4]
push dword [ebx]
push str.497_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x728], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x730], eax
mov eax, dword [ebx + 4]
push ebx
push dword [ebp - 0x724]
mov dword [ebp - 0x750], eax
lea eax, [ebp - 0x844]
push eax
call fcn.0042afa0
push 0
push 1
push 0
push dword [ebp - 0x728]
mov dword [ebp - 4], 0x23
push dword [ebp - 0x730]
push dword [ebp - 0x750]
push dword [eax]
call fcn.0047fdb0
mov edx, dword [ebp - 0x844]
add esp, 0x40
jmp 0x492a1d
push str._unsetappcap
push dword [ebx + 4]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x492c63
push str.office6ksomisc.exe
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x492c63
push dword [ebx + 4]
push dword [ebx]
push str.504_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x728], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x730], eax
mov eax, dword [ebx + 4]
push ebx
push dword [ebp - 0x724]
mov dword [ebp - 0x750], eax
lea eax, [ebp - 0x848]
push eax
call fcn.0042afa0
push 0
push 1
push 0
push dword [ebp - 0x728]
mov dword [ebp - 4], 0x24
push dword [ebp - 0x730]
push dword [ebp - 0x750]
push dword [eax]
call fcn.0047fdb0
mov edx, dword [ebp - 0x848]
add esp, 0x40
jmp 0x492a1d
push str._unassopic_uninstall
push dword [ebx + 4]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x492d12
push str.office6ksomisc.exe
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x492d12
push dword [ebx + 4]
push dword [ebx]
push str.511_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x728], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x730], eax
mov eax, dword [ebx + 4]
push ebx
push dword [ebp - 0x724]
mov dword [ebp - 0x750], eax
lea eax, [ebp - 0x84c]
push eax
call fcn.0042afa0
push 0
push 1
push 0
push dword [ebp - 0x728]
mov dword [ebp - 4], 0x25
push dword [ebp - 0x730]
push dword [ebp - 0x750]
push dword [eax]
call fcn.0047fdb0
mov edx, dword [ebp - 0x84c]
add esp, 0x40
jmp 0x492a1d
push str.UninstallQing
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x492d5c
push str.517_tKUninstall::ExecuteBeforeDeleteFiles_tDo_Qing_Uninstall.
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
push dword [ebp - 0x724]
call fcn.00480b50
mov ecx, dword [ebp - 0x720]
add esp, 0x14
call fcn.00491760
jmp 0x4949ef
push str.UninstallPdf2wordSdk
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x492da2
call fcn.00441c60
test eax, eax
je 0x4949ef
push str.526_tKUninstall::ExecuteBeforeDeleteFiles_tDo_Pdf2wordSdk_Uninstall.
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
add esp, 0x10
call fcn.0049f810
jmp 0x4949ef
push str.UnRegisterDataMaster
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x492df4
push str.533_tKUninstall::ExecuteBeforeDeleteFiles_tDo_UnRegisterDataMaster
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov ecx, dword [ebp - 0x720]
add esp, 0x10
push 0
push 0
call fcn.00499110
mov ecx, dword [ebp - 0x720]
push 1
push 0
call fcn.00499110
jmp 0x4949ef
push str.UnRegisterKWpsWinAppExt
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x492e38
push str.540_tKUninstall::ExecuteBeforeDeleteFiles_tDo_UnRegisterKWpsWinAppExt
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov ecx, dword [ebp - 0x720]
add esp, 0x10
push dword [ebx + 8]
push 0
call fcn.00499660
jmp 0x4949ef
push str.UnRegisterDocEncryptShellExt
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x492f78
push str.546_tKUninstall::ExecuteBeforeDeleteFiles_tDo_UnRegisterDocEncryptShellExt
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
push str.office6_addonsdocencryptshellext_
push dword [ebp - 0x724]
lea eax, [ebp - 0x76c]
push eax
call fcn.00429810
add esp, 0x1c
mov dword [ebp - 4], 0x26
call fcn.0047e850
test eax, eax
mov edx, str.docencryptshellext64.dll
mov eax, str.docencryptshellext.dll
cmove edx, eax
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x492ea2
sub ecx, ebx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x76c]
call fcn.004299d0
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x494a51
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x760], eax
mov ebx, str.user
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x760]
test ebx, 0xffff0000
jne 0x492efd
movzx eax, bx
push eax
call fcn.00429d90
jmp 0x492f09
push 4
push str.user
call fcn.0042a060
mov eax, dword [ebp - 0x720]
mov byte [ebp - 4], 0x28
push 0
cmp dword [eax + 0xdc], 0
jne 0x492f38
lea eax, [ebp - 0x760]
push eax
lea eax, [ebp - 0x76c]
push eax
push 0
call fcn.00448d80
add esp, 0x10
jmp 0x492f4f
lea ecx, [ebp - 0x760]
push ecx
lea ecx, [ebp - 0x76c]
push ecx
push 0
mov ecx, eax
call fcn.0049c000
mov edx, dword [ebp - 0x760]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x492f6d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x76c]
jmp 0x492a1d
push str.UnRegisterKPdfContextMenuShellExt
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x492fca
push str.552_tKUninstall::ExecuteBeforeDeleteFiles_tDo_UnRegisterKPdfContextMenuShellExt
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov ecx, dword [ebp - 0x720]
add esp, 0x10
push 0
push 0
call fcn.004994f0
mov ecx, dword [ebp - 0x720]
push 1
push 0
call fcn.004994f0
jmp 0x4949ef
push str.UninstallKingsoftVirtualPrinter
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x493011
push str.559_tKUninstall::ExecuteBeforeDeleteFiles_tUninstall_kingsoft_virtual_printer.
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov eax, dword [ebp - 0x724]
add esp, 0x10
mov ecx, dword [ebp - 0x720]
push dword [eax]
call fcn.0049d750
jmp 0x4949ef
push str.UnRegisterPdfwspv
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x4931ab
push str.565_tKUninstall::ExecuteBeforeDeleteFiles_tUnregister_pdfwspv
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
add esp, 0x10
call fcn.00486b40
test eax, eax
jne 0x493169
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x494a51
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x77c], eax
mov eax, str._unregpdfwspv
mov dword [ebp - 4], 0x29
lea ecx, [ebp - 0x77c]
test eax, 0xffff0000
jne 0x493092
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x49309e
push 0xd
push str._unregpdfwspv
call fcn.0042a060
push str.office6ksomisc.exe
push dword [ebp - 0x724]
lea eax, [ebp - 0x7ec]
mov dword [ebp - 4], 0x2a
push eax
call fcn.00429810
mov ebx, eax
push 0x5c0508
push dword [ebp - 0x724]
lea eax, [ebp - 0x7e8]
mov byte [ebp - 4], 0x2b
push eax
call fcn.00429810
push str.wps.exe
push eax
lea eax, [ebp - 0x850]
mov byte [ebp - 4], 0x2c
push eax
call fcn.00429810
lea ecx, [ebp - 0x77c]
mov byte [ebp - 4], 0x2d
push ecx
push ebx
push eax
call fcn.004801a0
mov edx, dword [ebp - 0x850]
add esp, 0x30
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x493122
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x7e8]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x493140
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x7ec]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49315e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x77c]
jmp 0x492a1d
push str.office6ksomisc.exe
push dword [ebp - 0x724]
lea eax, [ebp - 0x7f0]
push eax
call fcn.00429810
push 0
push 1
push 0
push 1
push 0xffffffffffffffff
push str._unregpdfwspv
push dword [eax]
mov dword [ebp - 4], 0x2e
call fcn.0047fdb0
mov edx, dword [ebp - 0x7f0]
add esp, 0x28
jmp 0x492a1d
push str.UninstallLockDefaultProgram
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x4931f2
push str.576_tKUninstall::ExecuteBeforeDeleteFiles_tUninstallLockDefaultProgram
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov eax, dword [ebp - 0x724]
add esp, 0x10
mov ecx, dword [ebp - 0x720]
push dword [eax]
call fcn.0049dad0
jmp 0x4949ef
push str.UnRegisterYunpan
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x493255
push str.582_tKUninstall::ExecuteBeforeDeleteFiles_tDo_UnRegisterYunpan
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov eax, dword [ebp - 0x724]
add esp, 0x10
push 0
push ecx
mov ebx, esp
mov dword [ebp - 0x728], ebx
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00429b80
mov ecx, dword [ebp - 0x720]
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.00499a60
jmp 0x4949ef
push str.UnRegisterPcdYunpan
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x4932fc
push str.588_tKUninstall::ExecuteBeforeDeleteFiles_tDo_UnRegisterPcdYunpan
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov eax, dword [ebp - 0x724]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00429b80
add eax, 0x10
add esp, 0x14
mov dword [ebp - 0x72c], eax
push 0x18
push str.office6wpsclouddisk.exe
lea ecx, [ebp - 0x72c]
mov dword [ebp - 4], 0x2f
call fcn.004299d0
mov esi, dword [ebp - 0x72c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4932d9
push 0
push 0
push esi
call fcn.0047ea40
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4949e9
mov ecx, dword [esi]
push esi
jmp 0x4949e4
push str.UnRegisterOverlayIconHandles
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x493459
push str.597_tKUninstall::ExecuteBeforeDeleteFiles_tDo_UnRegisterOverlayIconHandles
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov ebx, dword [ebp - 0x720]
add esp, 0x10
mov ecx, ebx
push 0
push 0
call fcn.004997c0
push 1
push 0
mov ecx, ebx
call fcn.004997c0
mov ebx, dword [ebx + 0x108]
lea ecx, [ebp - 0x658]
push 0x15
xor eax, eax
mov dword [ebp - 0x658], 0
push str.support_MBVersionFlag
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
call fcn.0042e330
lea eax, [ebp - 0x658]
mov dword [ebp - 4], 0x30
push eax
lea eax, [ebp - 0x640]
mov ecx, ebx
push eax
call fcn.00442f00
cmp dword [eax + 0x14], 8
jb 0x4933ae
mov eax, dword [eax]
push eax
call fcn.0057277d
mov edx, dword [ebp - 0x62c]
add esp, 4
neg eax
sbb ebx, ebx
neg ebx
cmp edx, 8
jb 0x4933fd
mov ecx, dword [ebp - 0x640]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4933f3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x494a6a
push edx
push ecx
call fcn.0055c524
add esp, 8
xor eax, eax
mov dword [ebp - 0x630], 0
mov word [ebp - 0x640], ax
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0x62c], 7
mov dword [ebp - 4], 0xffffffff
cmp eax, 8
jb 0x49343f
inc eax
lea ecx, [ebp - 0x658]
push eax
push dword [ebp - 0x658]
call fcn.00449e10
test ebx, ebx
je 0x4949ef
mov ecx, dword [ebp - 0x720]
push 0
call fcn.0049bbc0
jmp 0x4949ef
push str.UninstallWPSCDiskClean
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x4935a5
push str.607_tKUninstall::ExecuteBeforeDeleteFiles_tDo_WPSCDiskClean_Uninstall.
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
add esp, 0x10
lea ecx, [ebp - 0x7b0]
push str.WpsCDiskCleanTask
call fcn.004445b0
lea eax, [ebp - 0x7b0]
mov dword [ebp - 4], 0x31
push eax
call fcn.0047a1a0
mov edx, dword [ebp - 0x7b0]
add esp, 4
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4934d9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
test ebx, ebx
setns al
push eax
push str.3956_tKUninstall::DoWPSCDiskCleanUninstall_tDelete_WpsCDiskCleanTask_tResult_d
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
add esp, 0x14
push 0
lea eax, [ebp - 0x754]
mov dword [ebp - 4], 0x32
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREkingsoftOffice6.0pluginskcdiskclean
push 0x80000001
mov dword [ebp - 0x754], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x49357e
push str.3961_tKUninstall::DoWPSCDiskCleanUninstall_tDelete_WpsCDiskClean_Register_createdPlanTaskcreatedDesktopLink_
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov eax, dword [ebp - 0x754]
add esp, 0x10
test eax, eax
je 0x493584
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.createdPlanTask
push eax
call ebx
mov eax, dword [ebp - 0x754]
test eax, eax
je 0x493584
push str.createdDesktopLink
push eax
call ebx
mov eax, dword [ebp - 0x754]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x493596
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x754], 0
jmp 0x4949ef
push str.DeleteExternalTask
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x493602
push str.613_tKUninstall::ExecuteBeforeDeleteFiles_tDeleting_external_task.
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
add esp, 0x10
lea ecx, [ebp - 0x7b4]
push str.WpsExternal_
call fcn.004445b0
lea eax, [ebp - 0x7b4]
mov dword [ebp - 4], 0x33
push eax
call fcn.0047a1a0
mov edx, dword [ebp - 0x7b4]
jmp 0x492a1a
push str.DeleteOemPreinstallTask
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x49365f
push str.619_tKUninstall::ExecuteBeforeDeleteFiles_tDeleting_preinstall_longon_startup_task.
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
add esp, 0x10
lea ecx, [ebp - 0x7b8]
push str.WPSOffice_Init
call fcn.004445b0
lea eax, [ebp - 0x7b8]
mov dword [ebp - 4], 0x34
push eax
call fcn.0047a1a0
mov edx, dword [ebp - 0x7b8]
jmp 0x492a1a
push str.wtoolexwpsupdatesvr.exe
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x49372b
mov esi, dword [ebx + 4]
lea eax, [ebp - 0x7f4]
push ebx
push dword [ebp - 0x724]
push eax
call fcn.0042afa0
push esi
push dword [eax]
mov dword [ebp - 4], 0x35
push str.625_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov edx, dword [ebp - 0x7f4]
add esp, 0x24
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4936d7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x728], eax
mov eax, dword [ebx + 4]
push ebx
push dword [ebp - 0x724]
mov dword [ebp - 0x730], eax
lea eax, [ebp - 0x7f8]
push eax
call fcn.0042afa0
push 0
push 1
push 0
push esi
push dword [ebp - 0x728]
mov dword [ebp - 4], 0x36
push dword [ebp - 0x730]
push dword [eax]
call fcn.0047fdb0
mov edx, dword [ebp - 0x7f8]
jmp 0x4949c7
push str.wtoolexwpsnotify.exe
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
je 0x493751
push str.wtoolexwpsupdate.exe
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x493769
push str._deltasks
push dword [ebx + 4]
call fcn.0056b422
add esp, 8
test eax, eax
je 0x4943bd
mov eax, dword [ebp - 0x720]
mov eax, dword [eax + 0x108]
mov dword [ebp - 0x728], eax
test eax, eax
je 0x49380b
push str.Support_UseWpsupdateXa
lea ecx, [ebp - 0x640]
call fcn.0043f5c0
mov ecx, dword [ebp - 0x728]
lea eax, [ebp - 0x640]
push eax
mov dword [ebp - 4], 0x37
call fcn.004a07c0
lea ecx, [ebp - 0x640]
mov byte [ebp - 0x719], al
mov dword [ebp - 4], 0xffffffff
call fcn.0042ab30
cmp byte [ebp - 0x719], 0
je 0x49380b
push str.wtoolexwpsnotify.exe
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
je 0x4937f3
push 0x5c4450
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x49380b
push str._deltasks
push dword [ebx + 4]
call fcn.0056b422
add esp, 8
test eax, eax
je 0x4943bd
push str.wtoolexwpsofficeupdate.exe
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
je 0x4943bd
push str.UninstallCloudSvr
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x493868
mov ecx, dword [ebp - 0x720]
call fcn.00495980
push eax
call fcn.00440570
push eax
push str.655_tKUninstall::ExecuteBeforeDeleteFiles_t_INFO__KCloudsvrServiceReferenceMgr::tryUninstall_returned__ld
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
add esp, 0x18
jmp 0x4949ef
push str.UninstallWPSDocCenter
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x493988
push str.660_tKUninstall::ExecuteBeforeDeleteFiles_tStop_WPSDocCenter
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov eax, dword [ebp - 0x724]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00429b80
add eax, 0x10
add esp, 0x14
mov dword [ebp - 0x72c], eax
push 0x18
push str.office6wpsdoccenter.exe
lea ecx, [ebp - 0x72c]
mov dword [ebp - 4], 0x38
call fcn.004299d0
mov esi, dword [ebp - 0x72c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4938ec
push 0
push 0
push esi
call fcn.0047ea40
add esp, 0xc
mov eax, dword [ebp - 0x720]
cmp dword [eax + 0x20], 0
jne 0x4932d9
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00560a80
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 5
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x788]
call fcn.004445b0
push 0x14
push str.WPS_MiniCloud_Files
lea ecx, [ebp - 0x788]
mov byte [ebp - 4], 0x39
call fcn.004299d0
push 0
push 1
push 1
push dword [ebp - 0x788]
call fcn.0047a3e0
mov edx, dword [ebp - 0x788]
add esp, 0x10
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4932d9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4932d9
push str.deleteFirewallRule
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x4939c7
push str.670_tKUninstall::ExecuteBeforeDeleteFiles_tdeleteFirewallRule
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov ecx, dword [ebp - 0x720]
add esp, 0x10
call fcn.0048ba00
jmp 0x4949ef
push str.msiexec.exe
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x493aa1
mov eax, dword [ebp - 0x724]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00429b80
add eax, 0x10
mov dword [ebp - 0x764], eax
lea eax, [ebp - 0x764]
mov dword [ebp - 4], 0x3a
push eax
call fcn.0047fa90
add esp, 8
lea ecx, [ebp - 0x764]
push 0x13
push str.utilityinstall.ini
call fcn.004299d0
push dword [ebp - 0x764]
push 0
push 0x5c4640
push str.installinfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
jne 0x493a96
push dword [ebp - 0x764]
push 0x9c
push str.uselocal
push str.localInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0x188
jne 0x493a96
push dword [ebx + 4]
push dword [ebx]
push str.682_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
push 1
push 0
push 0
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
push dword [ebx]
call fcn.0047fdb0
add esp, 0x34
mov edx, dword [ebp - 0x764]
jmp 0x492a1d
push str.office6ksomisc.exe
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x493b89
mov eax, dword [ebx + 4]
cmp dword [eax - 0xc], 0
jl 0x493b89
push str._deletetaskbarpin
push eax
call fcn.00561570
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x493b89
sub ecx, dword [ebx + 4]
sar ecx, 1
cmp ecx, 0xffffffff
je 0x493b89
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00560a80
add esp, 0xc
lea eax, [ebp - 0x628]
push 0
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4943c7
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x784]
call fcn.004445b0
push 0x19
push str.KingsoftOffice6TaskBar
lea ecx, [ebp - 0x784]
mov dword [ebp - 4], 0x3b
call fcn.004299d0
push 0
push 1
push 1
push dword [ebp - 0x784]
call fcn.0047a3e0
mov edx, dword [ebp - 0x784]
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4943c7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4943c7
push str.office6WPSOfficePIA.exe
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x493bce
push dword [ebx + 4]
push dword [ebx]
push str.702_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov ecx, dword [ebp - 0x720]
add esp, 0x18
push ebx
call fcn.00491ab0
jmp 0x4949ef
push str.UninstallKtpcntr
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x493c96
push str.708_tKUninstall::ExecuteBeforeDeleteFiles_tUninstallKtpcntr
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
add esp, 0x10
lea ecx, [ebp - 0x7bc]
push str.WpsKtpcntrQingTask_
call fcn.004445b0
lea eax, [ebp - 0x7bc]
mov dword [ebp - 4], 0x3c
push eax
call fcn.0047a1a0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7bc]
call fcn.004296c0
push dword [ebp - 0x724]
lea ecx, [ebp - 0x7a4]
call fcn.00488660
push str.office6ktpcntr.exe
lea ecx, [ebp - 0x7a4]
mov dword [ebp - 4], 0x3d
call fcn.00489e50
mov esi, dword [ebp - 0x7a4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x493c7f
push 0
push 0
push esi
call fcn.0047ea40
add esp, 0xc
lea ecx, [ebp - 0x7a4]
mov dword [ebp - 4], 0xffffffff
call fcn.004296c0
jmp 0x4949e9
push str.UninstallSurvey
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x493f51
push str.718_tKUninstall::ExecuteBeforeDeleteFiles_tUninstallSurvey
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov eax, dword [ebp - 0x720]
lea ecx, [ebp - 0x640]
add esp, 0x10
mov ebx, dword [eax + 0x108]
push str.Support_UninstallSurvey
call fcn.0043f5c0
lea eax, [ebp - 0x640]
mov dword [ebp - 4], 0x3e
push eax
lea eax, [ebp - 0x658]
mov ecx, ebx
push eax
call fcn.00442f00
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0x3f
jb 0x493d0d
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x7dc]
call fcn.004445b0
lea ecx, [ebp - 0x658]
call fcn.0042ab30
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 0x42
call fcn.0042ab30
push 0x5bb494
push dword [ebp - 0x7dc]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x493f3a
lea ecx, [ebp - 0x718]
call fcn.004c02e0
mov ecx, dword [ebp - 0x720]
push dword [ebp - 0x72c]
add ecx, 0xd0
mov byte [ebp - 4], 0x43
call fcn.004297a0
lea eax, [ebp - 0x640]
push eax
lea ecx, [ebp - 0x718]
call fcn.004c07c0
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0x44
jb 0x493d92
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x800]
call fcn.004445b0
mov ebx, eax
push str._distsrc
lea ecx, [ebp - 0x7c0]
mov byte [ebp - 4], 0x45
call fcn.004444c0
push ebx
lea eax, [ebp - 0x7c0]
mov byte [ebp - 4], 0x46
push eax
lea eax, [ebp - 0x7fc]
push eax
call fcn.0042afa0
add esp, 0xc
mov ecx, dword [ebp - 0x720]
push eax
mov byte [ebp - 4], 0x47
lea ecx, [ecx + 0xd0]
call fcn.00489db0
lea ecx, [ebp - 0x7fc]
call fcn.004296c0
lea ecx, [ebp - 0x7c0]
call fcn.004296c0
lea ecx, [ebp - 0x800]
call fcn.004296c0
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 0x43
call fcn.0042ab30
lea eax, [ebp - 0x808]
mov ecx, 0x642094
push eax
call fcn.004c3120
mov ebx, eax
push str.lang
lea ecx, [ebp - 0x7d4]
mov byte [ebp - 4], 0x48
call fcn.004444c0
push ebx
lea eax, [ebp - 0x7d4]
mov byte [ebp - 4], 0x49
push eax
lea eax, [ebp - 0x82c]
push eax
call fcn.0042afa0
add esp, 0xc
mov ecx, dword [ebp - 0x720]
push eax
mov byte [ebp - 4], 0x4a
lea ecx, [ecx + 0xd0]
call fcn.00489db0
lea ecx, [ebp - 0x82c]
call fcn.004296c0
lea ecx, [ebp - 0x7d4]
call fcn.004296c0
lea ecx, [ebp - 0x808]
mov byte [ebp - 4], 0x43
call fcn.004296c0
lea eax, [ebp - 0x640]
push eax
lea ecx, [ebp - 0x718]
call fcn.004c1330
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0x4b
jb 0x493eb0
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x810]
call fcn.004445b0
mov ebx, eax
push 0x5c48d4
lea ecx, [ebp - 0x7d8]
mov byte [ebp - 4], 0x4c
call fcn.004444c0
push ebx
lea eax, [ebp - 0x7d8]
mov byte [ebp - 4], 0x4d
push eax
lea eax, [ebp - 0x80c]
push eax
call fcn.0042afa0
add esp, 0xc
mov ecx, dword [ebp - 0x720]
push eax
mov byte [ebp - 4], 0x4e
lea ecx, [ecx + 0xd0]
call fcn.00489db0
lea ecx, [ebp - 0x80c]
call fcn.004296c0
lea ecx, [ebp - 0x7d8]
call fcn.004296c0
lea ecx, [ebp - 0x810]
call fcn.004296c0
lea ecx, [ebp - 0x640]
call fcn.0042ab30
lea ecx, [ebp - 0x718]
call fcn.00488f30
lea ecx, [ebp - 0x7dc]
mov dword [ebp - 4], 0xffffffff
call fcn.004296c0
jmp 0x4949ef
push str.UninstallKscreenSaver
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x494314
push str.733_tKUninstall::ExecuteBeforeDeleteFiles_tDeleting_WpsKscreenSaver__Task.
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
add esp, 0x10
push str._kscreen__Delte_WpsKscreenSaver__Task
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.WpsKscreenSaver_
lea ecx, [ebp - 0x7e0]
call fcn.004445b0
lea eax, [ebp - 0x7e0]
mov dword [ebp - 4], 0x4f
push eax
call fcn.0047a1a0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7e0]
call fcn.004296c0
push str.office6_addonsksslinkerksslinker.dll
push dword [ebp - 0x724]
lea eax, [ebp - 0x814]
push eax
call fcn.00429810
add esp, 0xc
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [ebp - 0x814]
mov ebx, eax
call fcn.004296c0
test ebx, ebx
je 0x4949ef
mov ebx, dword [ebp - 0x724]
lea ecx, [ebp - 0x79c]
push ebx
call fcn.00488660
push str.office6_addonskscreensaverlauncher
lea ecx, [ebp - 0x79c]
mov dword [ebp - 4], 0x50
call fcn.00489e50
push 0
push 1
push 1
push dword [ebp - 0x79c]
call fcn.0047a3e0
add esp, 0x10
lea ecx, [ebp - 0x798]
push ebx
call fcn.00488660
push str.office6_addonskscrsvr
lea ecx, [ebp - 0x798]
mov byte [ebp - 4], 0x51
call fcn.00489e50
push 0
push 1
push 1
push dword [ebp - 0x798]
call fcn.0047a3e0
add esp, 0x10
lea eax, [ebp - 0x740]
mov dword [ebp - 0x740], 0
push eax
push 0x20019
push 0
push str.Control_PanelDesktop
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x794]
call fcn.0042a9e0
lea eax, [ebp - 0x794]
mov byte [ebp - 4], 0x53
push eax
push str.SCRNSAVE.EXE
lea ecx, [ebp - 0x740]
call fcn.004974d0
push 0xb
lea eax, [ebp - 0x818]
push eax
lea ecx, [ebp - 0x794]
call fcn.00429f50
push str.kscrsvr.scr
push dword [eax]
call fcn.0056b422
add esp, 8
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x818]
mov ebx, eax
call fcn.004296c0
test ebx, ebx
jne 0x494115
mov eax, dword [ebp - 0x740]
test eax, eax
je 0x49412a
push 2
push 0x5b8734
push 1
push ebx
push str.SCRNSAVE.EXE
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x740]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x494130
push eax
call ebx
jmp 0x494130
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.756_tKUninstall::ExecuteBeforeDeleteFiles_tDeleting_KScreensaverPendant_PowerBoot_regedit.
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
mov dword [ebp - 0x740], 0
call fcn.0046b730
add esp, 0x10
push str._kscreen__Deleting_KScreensaverPendant_PowerBoot_regedit.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x740]
test eax, eax
je 0x49416e
push eax
call ebx
lea eax, [ebp - 0x740]
mov dword [ebp - 0x740], 0
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x790]
call fcn.0042a9e0
lea eax, [ebp - 0x790]
mov byte [ebp - 4], 0x55
push eax
push str.KScreenSaverPendant
lea ecx, [ebp - 0x740]
call fcn.004974d0
mov eax, dword [ebp - 0x790]
cmp dword [eax - 0xc], 0
je 0x4941de
mov eax, dword [ebp - 0x740]
test eax, eax
je 0x4941eb
push str.KScreenSaverPendant
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x740]
test eax, eax
je 0x4941eb
push eax
call ebx
mov ebx, dword [ebp - 0x724]
lea eax, [ebp - 0x768]
push str.office6wps.exe
push ebx
push eax
mov dword [ebp - 0x740], 0
call fcn.00429810
push ebx
lea eax, [ebp - 0x81c]
mov byte [ebp - 4], 0x56
push str.Run__InstanceIdsslinker__
push eax
call fcn.00438f60
push str.office6_addonsksslinkerksslinker.dll___uninst
push eax
lea eax, [ebp - 0x78c]
mov byte [ebp - 4], 0x57
push eax
call fcn.00429810
add esp, 0x24
lea ecx, [ebp - 0x81c]
mov byte [ebp - 4], 0x59
call fcn.004296c0
call fcn.00486b40
test eax, eax
je 0x494283
push str._kscreen__Running_uninst_in_Admin_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push 1
push 0
push 0
push dword [0x6134fc]
push dword [ebp - 0x78c]
push dword [ebp - 0x768]
call fcn.0047fdb0
add esp, 0x1c
jmp 0x4942ab
push str._kscreen__Running_uninst_in_low_user_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [0x6134fc]
lea eax, [ebp - 0x78c]
push eax
lea eax, [ebp - 0x768]
push eax
push eax
call fcn.004802f0
add esp, 0x10
lea ecx, [ebp - 0x78c]
call fcn.004296c0
lea ecx, [ebp - 0x768]
call fcn.004296c0
lea ecx, [ebp - 0x790]
call fcn.004296c0
lea ecx, [ebp - 0x794]
call fcn.004296c0
mov eax, dword [ebp - 0x740]
test eax, eax
je 0x4942e8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x798]
mov dword [ebp - 0x740], 0
call fcn.004296c0
lea ecx, [ebp - 0x79c]
mov dword [ebp - 4], 0xffffffff
call fcn.004296c0
jmp 0x4949ef
push str.SupportWPS365
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x4943c7
mov dword [ebp - 0x7d0], eax
mov dword [ebp - 0x7cc], eax
mov dword [ebp - 0x7c8], eax
push 0x2001f
push str.SOFTWAREkingsoft
mov dword [ebp - 4], 0x5a
call fcn.00522410
push eax
lea ecx, [ebp - 0x7d0]
call fcn.00496f00
test eax, eax
jne 0x49438a
push str.WPS365
lea ecx, [ebp - 0x7d0]
call fcn.0043a090
mov eax, dword [ebp - 0x7d0]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x494396
push eax
call ebx
xor eax, eax
jmp 0x494396
mov eax, dword [ebp - 0x7d0]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x4943ae
push eax
call ebx
mov dword [ebp - 0x7d0], 0
mov dword [ebp - 0x7cc], 0
jmp 0x4949ef
mov dword [ebp - 0x758], 0
lea esi, [ebx + 4]
push str.office6ksomisc.exe
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x49448c
mov eax, dword [esi]
add eax, 0xfffffff0
mov ecx, dword [eax + 4]
mov dword [ebp - 0x728], ecx
cmp ecx, 0x11
jg 0x494408
push eax
call fcn.00429b80
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x7a0], esi
jmp 0x49444a
mov ecx, dword [eax]
test ecx, ecx
je 0x494419
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x494427
call fcn.00429250
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
mov eax, dword [esi]
mov edx, dword [ebp - 0x728]
push ecx
push 0x11
lea ecx, [ebp - 0x7a0]
lea eax, [eax + edx*2]
add eax, 0xffffffde
push eax
call fcn.00488690
mov esi, dword [ebp - 0x7a0]
mov eax, dword [ebp - 0x734]
or eax, 0x10
or eax, 4
push str._forceperusermode
push esi
mov dword [ebp - 0x734], eax
mov dword [ebp - 0x74c], eax
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x494492
mov eax, dword [ebp - 0x720]
cmp dword [eax + 0xdc], 0
je 0x494492
mov byte [ebp - 0x719], 1
jmp 0x494499
mov esi, dword [ebp - 0x7a0]
mov byte [ebp - 0x719], 0
mov eax, dword [ebp - 0x734]
mov dword [ebp - 4], 0xffffffff
test al, 4
je 0x4944d1
and eax, 0xfffffffb
add esi, 0xfffffff0
mov dword [ebp - 0x734], eax
mov dword [ebp - 0x74c], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4944d1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x719], 0
je 0x49460d
mov esi, dword [ebx + 4]
mov eax, dword [ebp - 0x724]
mov dword [ebp - 4], 0x5c
mov eax, dword [eax]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x494500
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x49450c
call fcn.00429250
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov byte [ebp - 4], 0x5d
test eax, eax
je 0x494a51
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov ecx, dword [ebp - 0x724]
add eax, 0x10
mov dword [ebp - 0x7e4], eax
mov eax, dword [ebp - 0x734]
or eax, 0x20
mov byte [ebp - 4], 0x5c
mov ecx, dword [ecx]
mov dword [ebp - 0x734], eax
mov dword [ebp - 0x74c], eax
mov eax, dword [ebx]
push dword [eax - 0xc]
push eax
push dword [ecx - 0xc]
lea eax, [ebp - 0x7e4]
push ecx
push eax
call fcn.0042b6f0
push esi
mov esi, dword [ebp - 0x7e4]
push esi
push str.798_tKUninstall::ExecuteBeforeDeleteFiles_tSend_msg_to_run_app:_ws__params_ws
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov eax, dword [ebp - 0x734]
add esp, 0x2c
and eax, 0xffffffdf
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x734], eax
add esi, 0xfffffff0
mov dword [ebp - 0x74c], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4945b7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx + 0xc]
mov eax, dword [ebx + 4]
push dword [ebx + 8]
sub eax, 0x10
push ecx
mov esi, esp
mov dword [ebp - 0x728], esp
push eax
mov dword [ebp - 0x730], esi
call fcn.00429b80
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0x5e
mov eax, esp
push ebx
push dword [ebp - 0x724]
push eax
call fcn.0042afa0
mov ecx, dword [ebp - 0x720]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
call fcn.0049c0e0
jmp 0x4949e9
push str._unregmso2pdfplugins
push dword [ebx + 4]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x4946a7
push str.office6ksomisc.exe
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x4946a7
push str.805_tKUninstall::ExecuteBeforeDeleteFiles_tUnRegistering_KMso2PdfPlugins.
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov eax, dword [ebx + 8]
lea ecx, [ebx + 4]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x728], eax
mov eax, dword [ecx]
push ebx
push dword [ebp - 0x724]
mov dword [ebp - 0x730], eax
lea eax, [ebp - 0x820]
push eax
call fcn.0042afa0
push 0
push 1
push 0
push esi
push dword [ebp - 0x728]
mov dword [ebp - 4], 0x5f
push dword [ebp - 0x730]
push dword [eax]
call fcn.0047fdb0
mov edx, dword [ebp - 0x820]
jmp 0x4947db
push str._unreghtml2PdfPlugins
push dword [ebx + 4]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x494742
push str.office6ksomisc.exe
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x494742
push str.811_tKUninstall::ExecuteBeforeDeleteFiles_tUnRegistering_KHtml2PdfPlugins.
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x728], eax
mov eax, dword [ebx + 4]
push ebx
push dword [ebp - 0x724]
mov dword [ebp - 0x730], eax
lea eax, [ebp - 0x824]
push eax
call fcn.0042afa0
push 0
push 1
push 0
push esi
push dword [ebp - 0x728]
mov dword [ebp - 4], 0x60
push dword [ebp - 0x730]
push dword [eax]
call fcn.0047fdb0
mov edx, dword [ebp - 0x824]
add esp, 0x38
jmp 0x4949ca
push str._delJsapiCert
push dword [ebx + 4]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x4947f9
push str.office6ksomisc.exe
push dword [ebx]
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x4947f9
push str.818_tKUninstall::ExecuteBeforeDeleteFiles_tdelJsapiCert.
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov eax, dword [ebx + 8]
lea ecx, [ebx + 4]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x728], eax
mov eax, dword [ecx]
push ebx
push dword [ebp - 0x724]
mov dword [ebp - 0x730], eax
lea eax, [ebp - 0x828]
push eax
call fcn.0042afa0
push 0
push 1
push 0
push esi
push dword [ebp - 0x728]
mov dword [ebp - 4], 0x61
push dword [ebp - 0x730]
push dword [eax]
call fcn.0047fdb0
mov edx, dword [ebp - 0x828]
or eax, 0xffffffff
add edx, 0xfffffff0
mov dword [ebp - 4], eax
add esp, 0x38
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4947f9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebx + 4]
lea eax, [ebp - 0x854]
push ebx
push dword [ebp - 0x724]
push eax
call fcn.0042afa0
push esi
push dword [eax]
mov dword [ebp - 4], 0x62
push str.821_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov edx, dword [ebp - 0x854]
add esp, 0x24
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49485a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x758], 0
je 0x494917
mov eax, dword [ebp - 0x720]
cmp dword [eax + 0xe0], 0
je 0x494917
cmp dword [ebx + 0x10], 0
jne 0x494917
mov esi, dword [ebx + 4]
lea eax, [ebp - 0x830]
push ebx
push dword [ebp - 0x724]
push eax
call fcn.0042afa0
push esi
push dword [eax]
mov dword [ebp - 4], 0x63
push str.824_tKUninstall::ExecuteBeforeDeleteFiles_tSendMsgToRunProcess:_ws__params_ws
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov edx, dword [ebp - 0x830]
add esp, 0x24
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4948e5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx + 0xc]
mov eax, dword [ebx + 4]
push dword [ebx + 8]
sub eax, 0x10
push ecx
mov esi, esp
mov dword [ebp - 0x728], esp
push eax
mov dword [ebp - 0x730], esi
call fcn.00429b80
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0x64
jmp 0x4945e4
mov esi, dword [ebx + 4]
lea eax, [ebp - 0x834]
push ebx
push dword [ebp - 0x724]
push eax
call fcn.0042afa0
push esi
push dword [eax]
mov dword [ebp - 4], 0x65
push str.829_tKUninstall::ExecuteBeforeDeleteFiles_tRunApp:_ws__params_ws
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov edx, dword [ebp - 0x834]
add esp, 0x24
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x494978
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x728], eax
mov eax, dword [ebx + 4]
push ebx
push dword [ebp - 0x724]
mov dword [ebp - 0x730], eax
lea eax, [ebp - 0x7c4]
push eax
call fcn.0042afa0
push 0
push 1
push 0
push esi
push dword [ebp - 0x728]
mov dword [ebp - 4], 0x66
push dword [ebp - 0x730]
push dword [eax]
call fcn.0047fdb0
mov edx, dword [ebp - 0x7c4]
add esp, 0x28
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4949e9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x738]
mov eax, dword [ebp - 0x720]
mov esi, dword [esi]
mov dword [ebp - 0x738], esi
cmp esi, dword [eax + 0x84]
je 0x494a16
mov ecx, dword [ebp - 0x7a8]
mov edx, dword [ebp - 0x7ac]
jmp 0x491cd5
call fcn.00441be0
test eax, eax
je 0x494a2b
push 0
push 0
call fcn.00460ab0
add esp, 8
call fcn.0043a250
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055c3a9
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00429b60
call fcn.0042a160
push 0x80070057
call fcn.00429b60
call fcn.0056af64
int3