Function at 0x4821d0
Capabilities:
Check if file exists
Delete registry value
Get common file path
Persist via run registry key
Persist via screensaver registry key
Print debug messages
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c592
mov eax, dword fs:[0]
push eax
sub esp, 0x5ec
mov eax, dword [0x61ce74]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x518], ebx
xor eax, eax
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x53c], eax
call fcn.0048c430
push str.219_tKUninstall::ExecuteBeforeDeleteFiles_tExecute_before_delete_files_...
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
lea eax, [ebx + 0x10]
push eax
mov dword [ebp - 0x520], eax
call fcn.00475a20
add esp, 0x14
mov ecx, ebx
call fcn.0048d500
mov eax, dword [ebx + 0x84]
xor ecx, ecx
mov edx, dword [ebx + 0x88]
mov dword [ebp - 0x58c], edx
mov esi, dword [eax]
mov dword [ebp - 0x538], esi
cmp esi, eax
je 0x484c81
mov edi, dword [ebp - 0x594]
mov dword [ebp - 0x540], edi
jmp 0x482280
inc ecx
push edx
mov dword [ebp - 0x588], ecx
push ecx
mov ecx, 0x629f50
call fcn.004a7ec0
mov ecx, dword [ebp - 0x518]
mov eax, dword [ecx + 0x54]
test eax, eax
je 0x4822ba
push dword [ecx + 0x28]
push dword [ebp - 0x58c]
push dword [ebp - 0x588]
call eax
mov ecx, dword [ebp - 0x518]
add esp, 0xc
cmp dword [ecx + 0xdc], 0
je 0x4822d6
cmp dword [ecx + 0xe0], 0
mov dword [ebp - 0x544], 1
jne 0x4822e0
mov dword [ebp - 0x544], 0
mov ebx, dword [esi + 8]
lea eax, [ebx + 4]
mov dword [ebp - 0x52c], ebx
push str._sendinstalldyn
push dword [eax]
mov dword [ebp - 0x51c], eax
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x482a97
push str.office6ksomisc.exe
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x482a97
call fcn.0043c120
test eax, eax
je 0x482396
push 0
lea eax, [ebp - 0x5c0]
push str.InfoCollect
push eax
call fcn.00459c10
mov ecx, dword [ebp - 0x528]
add esp, 0xc
or ecx, 1
mov dword [ebp - 0x528], ecx
mov eax, dword [eax]
mov dword [ebp - 0x53c], ecx
mov ecx, 0x5b151c
jmp 0x482360
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x482386
test dx, dx
je 0x482382
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x482386
add eax, 4
add ecx, 4
test dx, dx
jne 0x482360
xor eax, eax
jmp 0x48238b
sbb eax, eax
or eax, 1
mov byte [ebp - 0x511], 1
test eax, eax
je 0x48239d
mov byte [ebp - 0x511], 0
mov eax, dword [ebp - 0x528]
test al, 1
je 0x4823d4
mov edx, dword [ebp - 0x5c0]
and eax, 0xfffffffe
mov dword [ebp - 0x528], eax
add edx, 0xfffffff0
mov dword [ebp - 0x53c], eax
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4823d4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x511], 0
jne 0x484c5a
mov eax, dword [ebp - 0x518]
mov esi, 0x5b3ec4
cmp dword [eax + 4], 0
mov eax, 0x5b151c
cmove esi, eax
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x484cb5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x51c], eax
mov dword [ebp - 4], 0
test esi, 0xffff0000
jne 0x482435
movzx eax, si
lea ecx, [ebp - 0x51c]
push eax
call fcn.00426130
jmp 0x48245c
mov ecx, esi
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x482440
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x51c]
call fcn.004263f0
mov dword [ebp - 4], 1
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x484cb5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x524], eax
mov eax, str.info_mode
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x524]
test eax, 0xffff0000
jne 0x4824a1
movzx eax, ax
push eax
call fcn.00426130
jmp 0x4824ad
push 9
push str.info_mode
call fcn.004263f0
mov byte [ebp - 4], 3
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x484cb5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x52c], eax
mov edi, str.string
mov byte [ebp - 4], 4
shr edi, 0x10
lea ecx, [ebp - 0x52c]
test edi, edi
jne 0x4824f4
mov eax, str.string
movzx eax, ax
push eax
call fcn.00426130
jmp 0x482500
push 6
push str.string
call fcn.004263f0
mov esi, dword [str.SOFTWAREKingsoftOffice6.0Uninstall]
mov byte [ebp - 4], 5
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x484cb5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x530], eax
mov byte [ebp - 4], 6
test esi, esi
je 0x482561
test esi, 0xffff0000
jne 0x482548
movzx eax, si
lea ecx, [ebp - 0x530]
push eax
call fcn.00426130
jmp 0x482570
mov ecx, esi
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x482550
sub ecx, edx
sar ecx, 1
jmp 0x482563
xor ecx, ecx
push ecx
push esi
lea ecx, [ebp - 0x530]
call fcn.004263f0
mov ecx, dword [ebp - 0x518]
lea eax, [ebp - 0x51c]
push 0
push eax
lea eax, [ebp - 0x524]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x530]
push eax
call fcn.0048c2b0
mov edx, dword [ebp - 0x530]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4825bf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x52c]
or eax, 0xffffffff
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4825e1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x524]
or eax, 0xffffffff
mov byte [ebp - 4], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x482603
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x51c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x482628
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x518]
mov esi, 0x5b3ec4
cmp dword [eax + 0x20], 0
mov eax, 0x5b151c
cmove esi, eax
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x484cb5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x530], eax
mov dword [ebp - 4], 8
test esi, 0xffff0000
jne 0x48267c
movzx eax, si
lea ecx, [ebp - 0x530]
push eax
call fcn.00426130
jmp 0x48269d
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x482681
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x530]
call fcn.004263f0
mov dword [ebp - 4], 9
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x484cb5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x52c], eax
mov eax, str.info_savedata
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x52c]
test eax, 0xffff0000
jne 0x4826e2
movzx eax, ax
push eax
call fcn.00426130
jmp 0x4826ee
push 0xd
push str.info_savedata
call fcn.004263f0
mov byte [ebp - 4], 0xb
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x484cb5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x524], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x524]
test edi, edi
jne 0x48272d
mov eax, str.string
movzx eax, ax
push eax
call fcn.00426130
jmp 0x482739
push 6
push str.string
call fcn.004263f0
mov esi, dword [str.SOFTWAREKingsoftOffice6.0Uninstall]
mov byte [ebp - 4], 0xd
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x484cb5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x51c], eax
mov byte [ebp - 4], 0xe
test esi, esi
je 0x482797
test esi, 0xffff0000
jne 0x482781
movzx eax, si
lea ecx, [ebp - 0x51c]
push eax
call fcn.00426130
jmp 0x4827a6
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x482786
sub ecx, edx
sar ecx, 1
jmp 0x482799
xor ecx, ecx
push ecx
push esi
lea ecx, [ebp - 0x51c]
call fcn.004263f0
mov ecx, dword [ebp - 0x518]
lea eax, [ebp - 0x530]
push 0
push eax
lea eax, [ebp - 0x52c]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x51c]
push eax
call fcn.0048c2b0
mov edx, dword [ebp - 0x51c]
or eax, 0xffffffff
mov byte [ebp - 4], 0xd
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4827f5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x524]
or eax, 0xffffffff
mov byte [ebp - 4], 0xb
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x482817
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x52c]
or eax, 0xffffffff
mov byte [ebp - 4], 9
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x482839
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x530]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48285e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x484cb5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x52c], eax
push 4
lea eax, [ebp - 0x52c]
mov dword [ebp - 4], 0x10
push 0x5c14f4
push eax
call fcn.004289d0
mov edi, dword [ebp - 0x52c]
lea ecx, [ebx + 4]
add esp, 0xc
push dword [edi - 0xc]
push edi
call fcn.00425dc0
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x484cb5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x524], eax
mov byte [ebp - 4], 0x11
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x484cb5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x51c], eax
mov byte [ebp - 4], 0x12
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x484cb5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0x518]
lea ecx, [ebp - 0x524]
add eax, 0x108
mov byte [ebp - 4], 0x13
push eax
call fcn.00427100
mov eax, dword [ebp - 0x518]
lea ecx, [ebp - 0x51c]
add eax, 0x10c
push eax
call fcn.00427100
mov eax, dword [ebp - 0x518]
lea ecx, [ebp - 0x530]
add eax, 0x110
push eax
call fcn.00427100
push 1
push 0x5b4a20
lea ecx, [ebx + 4]
call fcn.00425dc0
push 1
push 0x5b3b0c
lea ecx, [ebx + 4]
call fcn.00425dc0
mov eax, dword [ebp - 0x524]
lea ecx, [ebx + 4]
push dword [eax - 0xc]
push eax
call fcn.00425dc0
push 1
push 0x5b3b0c
lea ecx, [ebx + 4]
call fcn.00425dc0
push 1
push 0x5b4a20
lea ecx, [ebx + 4]
call fcn.00425dc0
push 1
push 0x5b3b0c
lea ecx, [ebx + 4]
call fcn.00425dc0
mov eax, dword [ebp - 0x51c]
lea ecx, [ebx + 4]
push dword [eax - 0xc]
push eax
call fcn.00425dc0
push 1
push 0x5b3b0c
lea ecx, [ebx + 4]
call fcn.00425dc0
push 1
push 0x5b4a20
lea ecx, [ebx + 4]
call fcn.00425dc0
push 1
push 0x5b3b0c
lea ecx, [ebx + 4]
call fcn.00425dc0
mov esi, dword [ebp - 0x530]
lea ecx, [ebx + 4]
push dword [esi - 0xc]
push esi
call fcn.00425dc0
push 1
push 0x5b3b0c
lea ecx, [ebx + 4]
call fcn.00425dc0
mov byte [ebp - 4], 0x12
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x482a2b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x51c]
or eax, 0xffffffff
mov byte [ebp - 4], 0x11
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x482a4d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x524]
or eax, 0xffffffff
mov byte [ebp - 4], 0x10
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x482a6f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x484665
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x484665
push str.office6ksomisc.exe
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x482b9b
mov eax, dword [ebx + 4]
cmp dword [eax - 0xc], 0x15
lea ecx, [eax - 0x10]
jg 0x482ad1
push ecx
call fcn.00425f70
add esp, 4
lea edi, [eax + 0x10]
mov dword [ebp - 0x540], edi
jmp 0x482b6a
mov ecx, dword [ecx]
test ecx, ecx
je 0x482ae2
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x482af0
call fcn.00421b80
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x524], eax
test ecx, ecx
je 0x484cb5
test eax, eax
je 0x484cc4
mov eax, dword [ecx]
push 2
push 0x15
call dword [eax]
test eax, eax
je 0x484cbf
cmp dword [eax + 8], 0x15
lea edi, [eax + 0x10]
mov dword [ebp - 0x540], edi
jl 0x484cc4
xor eax, eax
mov dword [edi - 0xc], 0x15
mov word [edi + 0x2a], ax
test edi, edi
jne 0x482b4f
call fcn.0054b18d
mov dword [eax], 0x16
call fcn.0054b0b3
jmp 0x482b6a
mov esi, dword [ebp - 0x524]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebp - 0x540]
mov esi, dword [ebp - 0x538]
mov eax, dword [ebp - 0x528]
or eax, 8
or eax, 2
push str._deletelink_startmenu
push edi
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x53c], eax
call fcn.0054b581
add esp, 8
mov byte [ebp - 0x511], 1
test eax, eax
je 0x482ba2
mov byte [ebp - 0x511], 0
mov eax, dword [ebp - 0x528]
mov dword [ebp - 4], 0xffffffff
test al, 2
je 0x482bda
and eax, 0xfffffffd
lea edx, [edi - 0x10]
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x53c], eax
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x482bda
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x511], 0
je 0x482e52
cmp byte [0x61b848], 0
je 0x484665
push str.280_tKUninstall::ExecuteBeforeDeleteFiles_tRead_Start_Menu_Directory_From_Windows_Registry_And_Delete_It.
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
mov byte [0x61b848], 0
call fcn.004638c0
mov ecx, dword [ebp - 0x518]
lea eax, [ebp - 0x554]
add esp, 0x10
push eax
call fcn.00485d10
mov eax, dword [ebp - 0x554]
mov dword [ebp - 4], 0x15
cmp dword [eax - 0xc], 0
je 0x482e2b
push eax
push str.284_tKUninstall::ExecuteBeforeDeleteFiles_tRead_Start_Menu_Directory_From_Windows_Registry_Successfully._Menu_Directory___ws
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov eax, dword [ebx + 4]
add esp, 0x14
cmp dword [eax - 0xc], 0
jl 0x482e47
push 0x5b3b0c
push eax
call fcn.00542853
add esp, 8
test eax, eax
je 0x482e47
sub eax, dword [ebx + 4]
sar eax, 1
cmp eax, 0xffffffff
je 0x482e47
push eax
lea eax, [ebp - 0x548]
push eax
lea ecx, [ebx + 4]
call fcn.00442e60
push 1
push 0x5b3b0c
lea ecx, [ebp - 0x548]
mov byte [ebp - 4], 0x16
call fcn.00425dc0
mov eax, dword [ebp - 0x554]
lea ecx, [ebp - 0x548]
push dword [eax - 0xc]
push eax
call fcn.00425dc0
push 1
push 0x5b3b0c
lea ecx, [ebp - 0x548]
call fcn.00425dc0
cmp dword [ebp - 0x544], 0
je 0x482d6d
mov eax, dword [ebp - 0x518]
cmp dword [eax + 0xe0], 0
je 0x482d6d
push dword [ebx + 4]
push dword [ebx]
push str.295_tKUninstall::ExecuteBeforeDeleteFiles_tSendMsgToRunProcess:_ws__params_ws
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
add esp, 0x18
push dword [ebx + 0xc]
push dword [ebx + 8]
push ecx
mov ebx, esp
mov dword [ebp - 0x51c], esp
mov dword [ebp - 0x524], ebx
mov esi, dword [ebp - 0x548]
lea eax, [esi - 0x10]
push eax
call fcn.00425f70
add eax, 0x10
mov dword [ebx], eax
mov eax, esp
mov byte [ebp - 4], 0x17
push dword [ebp - 0x52c]
push dword [ebp - 0x520]
push eax
call fcn.00427170
mov ecx, dword [ebp - 0x518]
add esp, 0xc
mov byte [ebp - 4], 0x16
call fcn.0048bc30
jmp 0x482de1
push dword [ebx + 4]
push dword [ebx]
push str.300_tKUninstall::ExecuteBeforeDeleteFiles_tRunApp:_ws__params_ws
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
push ebx
push dword [ebp - 0x520]
lea eax, [ebp - 0x5e4]
push eax
call fcn.00427170
mov esi, dword [ebp - 0x548]
push 0
push 1
push 0
push dword [ebx + 0xc]
mov byte [ebp - 4], 0x18
push dword [ebx + 8]
push esi
push dword [eax]
call fcn.00474e60
mov edx, dword [ebp - 0x5e4]
add esp, 0x40
mov byte [ebp - 4], 0x16
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x482de1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x15
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x482dfd
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x554]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x484c54
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x484c54
push str.307_tKUninstall::ExecuteBeforeDeleteFiles_tFailed_to_Read_Start_Menu_Directory_From_Windows_Registry.
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
add esp, 0x10
mov edx, dword [ebp - 0x554]
jmp 0x483cad
push str.killproc
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x482e97
mov ebx, dword [ebp - 0x51c]
push dword [ebx]
push str.314_tKUninstall::ExecuteBeforeDeleteFiles_tKill_Process:_ws
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
push 1
push dword [ebx]
call fcn.00475f80
add esp, 0x1c
jmp 0x484c5a
push str.StopPluginHost
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x483001
mov eax, dword [ebp - 0x51c]
push dword [eax]
push str.322_tKUninstall::ExecuteBeforeDeleteFiles_tStopping_wpscloudsvr:_ws
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
add esp, 0x14
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x484cb5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x558], eax
mov ebx, 0x5b4a24
mov dword [ebp - 4], 0x19
shr ebx, 0x10
lea ecx, [ebp - 0x558]
test ebx, ebx
jne 0x482f18
mov eax, 0x5b4a24
movzx eax, ax
push eax
call fcn.00426130
jmp 0x482f24
push 0xb
push 0x5b4a24
call fcn.004263f0
lea eax, [ebp - 0x558]
mov dword [ebp - 4], 0x1a
push eax
call fcn.00475960
mov edx, dword [ebp - 0x558]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x482f5f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x520]
call fcn.00475a20
add esp, 4
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x484cb5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x55c], eax
mov dword [ebp - 4], 0x1b
test ebx, ebx
jne 0x482fab
mov ecx, 0x5b4a24
movzx eax, cx
lea ecx, [ebp - 0x55c]
push eax
call fcn.00426130
jmp 0x482fbd
push 0xb
push 0x5b4a24
lea ecx, [ebp - 0x55c]
call fcn.004263f0
lea eax, [ebp - 0x55c]
mov dword [ebp - 4], 0x1c
push eax
call fcn.00475960
mov edx, dword [ebp - 0x55c]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x484c5a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x484c5a
push str.regsvr32
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x483092
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00540d70
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.System32_regsvr32.exe
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0055418d
mov ebx, dword [ebp - 0x51c]
push dword [ebx]
push str.335_tKUninstall::ExecuteBeforeDeleteFiles_tRegsvr32:_ws
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
push 1
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebx]
lea eax, [ebp - 0x218]
push eax
call fcn.00474e60
add esp, 0x3c
jmp 0x484c5a
push str._unregmtfont
push dword [ebx + 4]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x483115
push str.office6ksomisc.exe
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x483115
push dword [ebx + 4]
push dword [ebx]
push str.343_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
push ebx
push dword [ebp - 0x520]
lea eax, [ebp - 0x5e8]
push eax
call fcn.00427170
push 0
push 1
push 0
push dword [ebx + 0xc]
mov dword [ebp - 4], 0x1d
push dword [ebx + 8]
push dword [ebx + 4]
push dword [eax]
call fcn.00474e60
mov edx, dword [ebp - 0x5e8]
add esp, 0x40
jmp 0x482fd9
push str._unsetappcap
push dword [ebx + 4]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x483198
push str.office6ksomisc.exe
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x483198
push dword [ebx + 4]
push dword [ebx]
push str.350_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
push ebx
push dword [ebp - 0x520]
lea eax, [ebp - 0x5ec]
push eax
call fcn.00427170
push 0
push 1
push 0
push dword [ebx + 0xc]
mov dword [ebp - 4], 0x1e
push dword [ebx + 8]
push dword [ebx + 4]
push dword [eax]
call fcn.00474e60
mov edx, dword [ebp - 0x5ec]
add esp, 0x40
jmp 0x482fd9
push str._unassopic_uninstall
push dword [ebx + 4]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x48321b
push str.office6ksomisc.exe
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x48321b
push dword [ebx + 4]
push dword [ebx]
push str.357_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
push ebx
push dword [ebp - 0x520]
lea eax, [ebp - 0x5f0]
push eax
call fcn.00427170
push 0
push 1
push 0
push dword [ebx + 0xc]
mov dword [ebp - 4], 0x1f
push dword [ebx + 8]
push dword [ebx + 4]
push dword [eax]
call fcn.00474e60
mov edx, dword [ebp - 0x5f0]
add esp, 0x40
jmp 0x482fd9
push str.UninstallQing
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x483265
push str.363_tKUninstall::ExecuteBeforeDeleteFiles_tDo_Qing_Uninstall.
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
push dword [ebp - 0x520]
call fcn.00475a20
mov ecx, dword [ebp - 0x518]
add esp, 0x14
call fcn.00481d00
jmp 0x484c5a
push str.UninstallPdf2wordSdk
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x4832ab
call fcn.0043c150
test eax, eax
je 0x484c5a
push str.372_tKUninstall::ExecuteBeforeDeleteFiles_tDo_Pdf2wordSdk_Uninstall.
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
add esp, 0x10
call fcn.0048ee30
jmp 0x484c5a
push str.UnRegisterDataMaster
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x4832fd
push str.379_tKUninstall::ExecuteBeforeDeleteFiles_tDo_UnRegisterDataMaster
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov ecx, dword [ebp - 0x518]
add esp, 0x10
push 0
push 0
call fcn.00488b40
mov ecx, dword [ebp - 0x518]
push 1
push 0
call fcn.00488b40
jmp 0x484c5a
push str.UnRegisterKWpsShellExt
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x48334f
push str.386_tKUninstall::ExecuteBeforeDeleteFiles_tDo_UnRegisterKWpsShellExt
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov ecx, dword [ebp - 0x518]
add esp, 0x10
push 0
push 0
call fcn.00489060
mov ecx, dword [ebp - 0x518]
push 1
push 0
call fcn.00489060
jmp 0x484c5a
push str.UnRegisterDocEncryptShellExt
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x48349a
push str.393_tKUninstall::ExecuteBeforeDeleteFiles_tDo_UnRegisterDocEncryptShellExt
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
push str.office6_addonsdocencryptshellext_
push dword [ebp - 0x520]
lea eax, [ebp - 0x560]
push eax
call fcn.00425c00
add esp, 0x1c
mov dword [ebp - 4], 0x20
call fcn.004742e0
test eax, eax
mov edx, str.docencryptshellext64.dll
mov eax, str.docencryptshellext.dll
cmove edx, eax
mov ecx, edx
lea ebx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4833c0
sub ecx, ebx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x560]
call fcn.00425dc0
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x484cb5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x54c], eax
mov ebx, str.user
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x54c]
test ebx, 0xffff0000
jne 0x48341b
movzx eax, bx
push eax
call fcn.00426130
jmp 0x483427
push 4
push str.user
call fcn.004263f0
mov eax, dword [ebp - 0x518]
mov byte [ebp - 4], 0x22
push 0
cmp dword [eax + 0xdc], 0
jne 0x483456
lea eax, [ebp - 0x54c]
push eax
lea eax, [ebp - 0x560]
push eax
push 0
call fcn.00443420
add esp, 0x10
jmp 0x48346d
lea ecx, [ebp - 0x54c]
push ecx
lea ecx, [ebp - 0x560]
push ecx
push 0
mov ecx, eax
call fcn.0048bb50
mov edx, dword [ebp - 0x54c]
or eax, 0xffffffff
mov byte [ebp - 4], 0x20
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48348f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x560]
jmp 0x482fd9
push str.UnRegisterKPdfContextMenuShellExt
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x4834ec
push str.399_tKUninstall::ExecuteBeforeDeleteFiles_tDo_UnRegisterKPdfContextMenuShellExt
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov ecx, dword [ebp - 0x518]
add esp, 0x10
push 0
push 0
call fcn.00488ef0
mov ecx, dword [ebp - 0x518]
push 1
push 0
call fcn.00488ef0
jmp 0x484c5a
push str.UninstallKingsoftVirtualPrinter
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x483533
push str.406_tKUninstall::ExecuteBeforeDeleteFiles_tUninstall_kingsoft_virtual_printer.
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov eax, dword [ebp - 0x520]
add esp, 0x10
mov ecx, dword [ebp - 0x518]
push dword [eax]
call fcn.0048cee0
jmp 0x484c5a
push str.UninstallLockDefaultProgram
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x48357a
push str.412_tKUninstall::ExecuteBeforeDeleteFiles_tUninstallLockDefaultProgram
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov eax, dword [ebp - 0x520]
add esp, 0x10
mov ecx, dword [ebp - 0x518]
push dword [eax]
call fcn.0048d260
jmp 0x484c5a
push str.UnRegisterYunpan
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x4835dd
push str.418_tKUninstall::ExecuteBeforeDeleteFiles_tDo_UnRegisterYunpan
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov eax, dword [ebp - 0x520]
add esp, 0x10
push 0
push ecx
mov ebx, esp
mov dword [ebp - 0x51c], ebx
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00425f70
mov ecx, dword [ebp - 0x518]
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.004896c0
jmp 0x484c5a
push str.UnRegisterOverlayIconHandles
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x483752
push str.424_tKUninstall::ExecuteBeforeDeleteFiles_tDo_UnRegisterOverlayIconHandles
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov ebx, dword [ebp - 0x518]
add esp, 0x10
mov ecx, ebx
push 0
push 0
call fcn.00489410
push 1
push 0
mov ecx, ebx
call fcn.00489410
push 0x15
xor eax, eax
mov dword [ebp - 0x428], 0
push str.support_MBVersionFlag
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
call fcn.00439df0
mov ecx, dword [ebx + 0x104]
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x450]
mov dword [ebp - 4], 0x23
push eax
call fcn.0043e2e0
cmp dword [eax + 0x14], 8
jb 0x483683
mov eax, dword [eax]
push eax
call fcn.005544de
mov edx, dword [ebp - 0x43c]
add esp, 4
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
cmp edx, 8
jb 0x4836d4
mov ecx, dword [ebp - 0x450]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4836ca
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x484cce
push edx
push ecx
call fcn.0053d0af
add esp, 8
mov edx, dword [ebp - 0x424]
xor eax, eax
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 7
mov word [ebp - 0x450], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x483738
mov ecx, dword [ebp - 0x438]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x48372e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x484cce
push edx
push ecx
call fcn.0053d0af
add esp, 8
test ebx, ebx
je 0x484c5a
mov ecx, dword [ebp - 0x518]
push 0
call fcn.0048b6a0
jmp 0x484c5a
push str.DeleteExternalTask
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x4837f1
push str.434_tKUninstall::ExecuteBeforeDeleteFiles_tDeleting_external_task.
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
add esp, 0x10
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x484cb5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x564], eax
mov ebx, str.WpsExternal_
mov dword [ebp - 4], 0x24
lea ecx, [ebp - 0x564]
test ebx, 0xffff0000
jne 0x4837c7
movzx eax, bx
push eax
call fcn.00426130
jmp 0x4837d3
push 0xc
push str.WpsExternal_
call fcn.004263f0
lea eax, [ebp - 0x564]
mov dword [ebp - 4], 0x25
push eax
call fcn.00470550
mov edx, dword [ebp - 0x564]
jmp 0x482fd6
push str.DeleteOemPreinstallTask
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x483890
push str.440_tKUninstall::ExecuteBeforeDeleteFiles_tDeleting_preinstall_longon_startup_task.
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
add esp, 0x10
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x484cb5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x568], eax
mov ebx, str.WPSOffice_Init
mov dword [ebp - 4], 0x26
lea ecx, [ebp - 0x568]
test ebx, 0xffff0000
jne 0x483866
movzx eax, bx
push eax
call fcn.00426130
jmp 0x483872
push 0xe
push str.WPSOffice_Init
call fcn.004263f0
lea eax, [ebp - 0x568]
mov dword [ebp - 4], 0x27
push eax
call fcn.00470550
mov edx, dword [ebp - 0x568]
jmp 0x482fd6
push str.wtoolexwpsupdatesvr.exe
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x483945
push ebx
push dword [ebp - 0x520]
lea eax, [ebp - 0x5f4]
push eax
call fcn.00427170
push dword [ebx + 4]
mov dword [ebp - 4], 0x28
push dword [eax]
push str.446_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov edx, dword [ebp - 0x5f4]
add esp, 0x24
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x483907
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ebx
push dword [ebp - 0x520]
lea eax, [ebp - 0x5a8]
push eax
call fcn.00427170
push 0
push 1
push 0
push dword [ebx + 0xc]
mov dword [ebp - 4], 0x29
push dword [ebx + 8]
push dword [ebx + 4]
push dword [eax]
call fcn.00474e60
mov edx, dword [ebp - 0x5a8]
add esp, 0x28
jmp 0x482fd9
push str.wtoolexwpsnotify.exe
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
je 0x48396b
push str.wtoolexwpsupdate.exe
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x483983
push str._deltasks
push dword [ebx + 4]
call fcn.0054b581
add esp, 8
test eax, eax
je 0x48465b
mov eax, dword [ebp - 0x518]
cmp dword [eax + 0x104], 0
je 0x483a79
push 0x16
xor eax, eax
mov dword [ebp - 0x428], 0
push str.Support_UseWpsupdateXa
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
call fcn.00439df0
lea eax, [ebp - 0x438]
mov dword [ebp - 4], 0x2a
push eax
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax + 0x104]
call fcn.0048f8d0
mov edx, dword [ebp - 0x424]
mov byte [ebp - 0x511], al
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x483a37
mov ecx, dword [ebp - 0x438]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x483a27
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x484cce
push edx
push ecx
call fcn.0053d0af
mov al, byte [ebp - 0x511]
add esp, 8
test al, al
je 0x483a79
push str.wtoolexwpsnotify.exe
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
je 0x483a61
push 0x5c2078
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x483a79
push str._deltasks
push dword [ebx + 4]
call fcn.0054b581
add esp, 8
test eax, eax
je 0x48465b
push str.wtoolexwpsofficeupdate.exe
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
je 0x48465b
push str.UninstallCloudSvr
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x483ad6
mov ecx, dword [ebp - 0x518]
call fcn.00485930
push eax
call fcn.0043a920
push eax
push str.476_tKUninstall::ExecuteBeforeDeleteFiles_t_INFO__KCloudsvrServiceReferenceMgr::tryUninstall_returned__ld
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
add esp, 0x18
jmp 0x484c5a
push str.deleteFirewallRule
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x483b15
push str.481_tKUninstall::ExecuteBeforeDeleteFiles_tdeleteFirewallRule
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov ecx, dword [ebp - 0x518]
add esp, 0x10
call fcn.0047def0
jmp 0x484c5a
push str.msiexec.exe
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x483bef
mov eax, dword [ebp - 0x520]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00425f70
add eax, 0x10
mov dword [ebp - 0x550], eax
lea eax, [ebp - 0x550]
mov dword [ebp - 4], 0x2b
push eax
call fcn.00474b30
add esp, 8
lea ecx, [ebp - 0x550]
push 0x13
push str.utilityinstall.ini
call fcn.00425dc0
push dword [ebp - 0x550]
push 0
push 0x5c21cc
push str.installinfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
jne 0x483be4
push dword [ebp - 0x550]
push 0x9c
push str.uselocal
push str.localInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0x188
jne 0x483be4
push dword [ebx + 4]
push dword [ebx]
push str.493_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
push 1
push 0
push 0
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
push dword [ebx]
call fcn.00474e60
add esp, 0x34
mov edx, dword [ebp - 0x550]
jmp 0x482fd9
push str.office6ksomisc.exe
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x483cd5
mov eax, dword [ebx + 4]
cmp dword [eax - 0xc], 0
jl 0x483cd5
push str._deletetaskbarpin
push eax
call fcn.00542853
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x483cd5
sub ecx, dword [ebx + 4]
sar ecx, 1
cmp ecx, 0xffffffff
je 0x483cd5
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00540d70
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x484665
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x570]
call fcn.0043f5d0
push 0x19
push str.KingsoftOffice6TaskBar
lea ecx, [ebp - 0x570]
mov dword [ebp - 4], 0x2c
call fcn.00425dc0
push 1
push 1
push dword [ebp - 0x570]
call fcn.00470770
mov edx, dword [ebp - 0x570]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x484665
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x484665
push str.office6WPSOfficePIA.exe
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x483d1a
push dword [ebx + 4]
push dword [ebx]
push str.513_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov ecx, dword [ebp - 0x518]
add esp, 0x18
push ebx
call fcn.00482050
jmp 0x484c5a
push str.UninstallKtpcntr
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x483e14
push str.519_tKUninstall::ExecuteBeforeDeleteFiles_tUninstallKtpcntr
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
add esp, 0x10
lea ecx, [ebp - 0x590]
push str.WpsKtpcntrQingTask_
call fcn.0043f5d0
lea eax, [ebp - 0x590]
mov dword [ebp - 4], 0x2d
push eax
call fcn.00470550
mov edx, dword [ebp - 0x590]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x483d98
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x520]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00425f70
add eax, 0x10
add esp, 4
mov dword [ebp - 0x51c], eax
push 0x13
push str.office6ktpcntr.exe
lea ecx, [ebp - 0x51c]
mov dword [ebp - 4], 0x2e
call fcn.00425dc0
mov esi, dword [ebp - 0x51c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x483dec
push 0
push 0
push esi
call fcn.00474460
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x484c54
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x484c54
push str.UninstallSurvey
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x4841be
push str.529_tKUninstall::ExecuteBeforeDeleteFiles_tUninstallSurvey
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
add esp, 0x10
mov dword [ebp - 0x428], 0
xor eax, eax
mov dword [ebp - 0x424], 7
lea ecx, [ebp - 0x438]
mov word [ebp - 0x438], ax
push 0x17
push str.Support_UninstallSurvey
call fcn.00439df0
mov ebx, dword [ebp - 0x518]
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x450]
mov dword [ebp - 4], 0x2f
push eax
mov ecx, dword [ebx + 0x104]
call fcn.0043e2e0
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0x30
jb 0x483ea8
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x5a4]
call fcn.0043f5d0
lea ecx, [ebp - 0x450]
call fcn.00430d50
mov eax, dword [ebp - 0x424]
mov byte [ebp - 4], 0x33
cmp eax, 8
jb 0x483ee1
inc eax
lea ecx, [ebp - 0x438]
push eax
push dword [ebp - 0x438]
call fcn.0048edf0
push str.true
push dword [ebp - 0x5a4]
xor eax, eax
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x4841b3
lea ecx, [ebp - 0x510]
call fcn.004a8a40
push dword [ebp - 0x51c]
add ebx, 0xd0
mov byte [ebp - 4], 0x34
mov ecx, ebx
call fcn.00427100
push str._distsrc
lea ecx, [ebp - 0x598]
call fcn.0043f4e0
lea eax, [ebp - 0x450]
mov byte [ebp - 4], 0x35
push eax
lea ecx, [ebp - 0x510]
call fcn.004a8e20
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0x36
jb 0x483f6d
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x5b0]
call fcn.0043f5d0
push eax
lea eax, [ebp - 0x598]
mov byte [ebp - 4], 0x37
push eax
lea eax, [ebp - 0x5ac]
push eax
call fcn.00427170
add esp, 0xc
mov eax, dword [eax]
mov ecx, ebx
mov byte [ebp - 4], 0x38
push dword [eax - 0xc]
push eax
call fcn.00425dc0
mov edx, dword [ebp - 0x5ac]
or eax, 0xffffffff
mov byte [ebp - 4], 0x37
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x483fc7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5b0]
or eax, 0xffffffff
mov byte [ebp - 4], 0x36
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x483fe9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x450]
call fcn.00430d50
mov edx, dword [ebp - 0x598]
or eax, 0xffffffff
mov byte [ebp - 4], 0x34
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x484016
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.lang
lea ecx, [ebp - 0x59c]
call fcn.0043f4e0
lea eax, [ebp - 0x5b8]
mov byte [ebp - 4], 0x39
push eax
mov ecx, 0x629f1c
call fcn.004ab3c0
push eax
lea eax, [ebp - 0x59c]
mov byte [ebp - 4], 0x3a
push eax
lea eax, [ebp - 0x5b4]
push eax
call fcn.00427170
add esp, 0xc
mov eax, dword [eax]
mov ecx, ebx
mov byte [ebp - 4], 0x3b
push dword [eax - 0xc]
push eax
call fcn.00425dc0
mov edx, dword [ebp - 0x5b4]
or eax, 0xffffffff
mov byte [ebp - 4], 0x3a
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x484089
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5b8]
or eax, 0xffffffff
mov byte [ebp - 4], 0x39
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4840ab
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x59c]
or eax, 0xffffffff
mov byte [ebp - 4], 0x34
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4840cd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x5c2464
lea ecx, [ebp - 0x5a0]
call fcn.0043f4e0
lea eax, [ebp - 0x450]
mov byte [ebp - 4], 0x3c
push eax
lea ecx, [ebp - 0x510]
call fcn.004a9960
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0x3d
jb 0x4840ff
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x5dc]
call fcn.0043f5d0
push eax
lea eax, [ebp - 0x5a0]
mov byte [ebp - 4], 0x3e
push eax
lea eax, [ebp - 0x5bc]
push eax
call fcn.00427170
add esp, 0xc
mov eax, dword [eax]
mov ecx, ebx
mov byte [ebp - 4], 0x3f
push dword [eax - 0xc]
push eax
call fcn.00425dc0
mov edx, dword [ebp - 0x5bc]
or eax, 0xffffffff
mov byte [ebp - 4], 0x3e
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x484159
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5dc]
or eax, 0xffffffff
mov byte [ebp - 4], 0x3d
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48417b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x450]
call fcn.00430d50
mov edx, dword [ebp - 0x5a0]
or eax, 0xffffffff
mov byte [ebp - 4], 0x34
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4841a8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x510]
call fcn.0047cc40
mov edx, dword [ebp - 0x5a4]
jmp 0x482fd9
push str.UninstallKscreenSaver
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x484665
push str.544_tKUninstall::ExecuteBeforeDeleteFiles_tDeleting_WpsKscreenSaver__Task.
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
add esp, 0x10
push str._kscreen__Delte_WpsKscreenSaver__Task
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.WpsKscreenSaver_
lea ecx, [ebp - 0x57c]
call fcn.0043f5d0
lea eax, [ebp - 0x57c]
mov dword [ebp - 4], 0x40
push eax
call fcn.00470550
mov edx, dword [ebp - 0x57c]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x484247
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.office6_addonsksslinkerksslinker.dll
push dword [ebp - 0x520]
lea eax, [ebp - 0x5c4]
push eax
call fcn.00425c00
add esp, 0xc
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x5c4]
test eax, eax
sete bl
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48428c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
jne 0x484c5a
mov ebx, dword [ebp - 0x520]
mov eax, dword [ebx]
sub eax, 0x10
push eax
call fcn.00425f70
add eax, 0x10
add esp, 4
mov dword [ebp - 0x524], eax
push 0x23
push str.office6_addonskscreensaverlauncher
lea ecx, [ebp - 0x524]
mov dword [ebp - 4], 0x41
call fcn.00425dc0
push 1
push 1
push dword [ebp - 0x524]
call fcn.00470770
mov eax, dword [ebx]
sub eax, 0x10
push eax
call fcn.00425f70
add eax, 0x10
add esp, 0x10
mov dword [ebp - 0x52c], eax
push 0x16
push str.office6_addonskscrsvr
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 0x42
call fcn.00425dc0
mov edi, dword [ebp - 0x52c]
push 1
push 1
push edi
call fcn.00470770
add esp, 0xc
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [ebp - 0x534]
push eax
push str.Control_PanelDesktop
push 0x80000001
mov byte [ebp - 4], 0x43
mov dword [ebp - 0x534], 0
call esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x484cb5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x51c], eax
lea eax, [ebp - 0x51c]
mov byte [ebp - 4], 0x44
push eax
push str.SCRNSAVE.EXE
lea ecx, [ebp - 0x534]
call fcn.00487220
push 0xb
lea eax, [ebp - 0x5c8]
push eax
lea ecx, [ebp - 0x51c]
call fcn.004262f0
push str.kscrsvr.scr
push dword [eax]
call fcn.0054b581
mov edx, dword [ebp - 0x5c8]
add esp, 8
test eax, eax
mov byte [ebp - 4], 0x44
sete bl
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4843c2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x4843e7
mov eax, dword [ebp - 0x534]
test eax, eax
je 0x4843fc
push 2
push 0x5b0144
push 1
push 0
push str.SCRNSAVE.EXE
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x534]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x484402
push eax
call ebx
jmp 0x484402
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.567_tKUninstall::ExecuteBeforeDeleteFiles_tDeleting_KScreensaverPendant_PowerBoot_regedit.
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
mov dword [ebp - 0x534], 0
call fcn.004638c0
add esp, 0x10
push str._kscreen__Deleting_KScreensaverPendant_PowerBoot_regedit.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x534]
test eax, eax
je 0x484440
push eax
call ebx
lea eax, [ebp - 0x534]
mov dword [ebp - 0x534], 0
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x484cb5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x530], eax
lea eax, [ebp - 0x530]
mov byte [ebp - 4], 0x46
push eax
push str.KScreenSaverPendant
lea ecx, [ebp - 0x534]
call fcn.00487220
mov esi, dword [ebp - 0x530]
cmp dword [esi - 0xc], 0
je 0x4844b7
mov eax, dword [ebp - 0x534]
test eax, eax
je 0x4844c4
push str.KScreenSaverPendant
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x534]
test eax, eax
je 0x4844c4
push eax
call ebx
mov ebx, dword [ebp - 0x520]
lea eax, [ebp - 0x56c]
push str.office6wps.exe
push ebx
push eax
mov dword [ebp - 0x534], 0
call fcn.00425c00
push ebx
lea eax, [ebp - 0x5cc]
mov byte [ebp - 4], 0x47
push str.Run__InstanceIdsslinker__
push eax
call fcn.0043fd40
push str.office6_addonsksslinkerksslinker.dll___uninst
push eax
lea eax, [ebp - 0x574]
mov byte [ebp - 4], 0x48
push eax
call fcn.00425c00
add esp, 0x24
mov edx, dword [ebp - 0x5cc]
or eax, 0xffffffff
mov byte [ebp - 4], 0x4a
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x484537
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.0047b0a0
test eax, eax
je 0x48456f
push str._kscreen__Running_uninst_in_Admin_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push 1
push 0
push 0
push dword [0x61b84c]
push dword [ebp - 0x574]
push dword [ebp - 0x56c]
call fcn.00474e60
add esp, 0x1c
jmp 0x484597
push str._kscreen__Running_uninst_in_low_user_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [0x61b84c]
lea eax, [ebp - 0x574]
push eax
lea eax, [ebp - 0x56c]
push eax
push eax
call fcn.004751d0
add esp, 0x10
mov edx, dword [ebp - 0x574]
or eax, 0xffffffff
mov byte [ebp - 4], 0x47
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4845b9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x56c]
or eax, 0xffffffff
mov byte [ebp - 4], 0x46
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4845db
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x44
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4845f7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x51c]
or eax, 0xffffffff
mov byte [ebp - 4], 0x43
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x484619
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x534]
test eax, eax
je 0x48462a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x534], 0
add edi, 0xfffffff0
mov byte [ebp - 4], 0x41
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x484650
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x524]
jmp 0x484c33
mov dword [ebp - 0x544], 0
push str.office6ksomisc.exe
push dword [ebx]
call fcn.0054b581
add esp, 8
lea edi, [ebx + 4]
test eax, eax
jne 0x48471a
mov eax, dword [edi]
mov esi, dword [eax - 0xc]
lea ecx, [eax - 0x10]
cmp esi, 0x11
jg 0x4846a0
push ecx
call fcn.00425f70
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x578], esi
jmp 0x4846d8
mov ecx, dword [ecx]
test ecx, ecx
je 0x4846af
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x4846bb
call fcn.00421b80
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
push eax
mov eax, dword [edi]
lea ecx, [ebp - 0x578]
push 0x11
lea eax, [eax + esi*2]
add eax, 0xffffffde
push eax
call fcn.0047c390
mov esi, dword [ebp - 0x578]
mov eax, dword [ebp - 0x528]
or eax, 0x10
or eax, 4
push str._forceperusermode
push esi
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x53c], eax
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x484720
mov eax, dword [ebp - 0x518]
cmp dword [eax + 0xdc], 0
je 0x484720
mov byte [ebp - 0x511], 1
jmp 0x484727
mov esi, dword [ebp - 0x578]
mov byte [ebp - 0x511], 0
mov eax, dword [ebp - 0x528]
mov dword [ebp - 4], 0xffffffff
test al, 4
je 0x48475f
and eax, 0xfffffffb
add esi, 0xfffffff0
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x53c], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x48475f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x511], 0
je 0x48488a
mov esi, dword [ebp - 0x520]
mov dword [ebp - 4], 0x4c
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x48478b
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x48479f
call fcn.00421b80
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
test eax, eax
je 0x484cb5
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov ecx, dword [esi]
add eax, 0x10
mov dword [ebp - 0x580], eax
mov eax, dword [ebp - 0x528]
or eax, 0x20
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x53c], eax
mov eax, dword [ebx]
push dword [eax - 0xc]
push eax
push dword [ecx - 0xc]
lea eax, [ebp - 0x580]
push ecx
push eax
call fcn.00427890
push dword [edi]
mov esi, dword [ebp - 0x580]
push esi
push str.599_tKUninstall::ExecuteBeforeDeleteFiles_tSend_msg_to_run_app:_ws__params_ws
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov eax, dword [ebp - 0x528]
add esp, 0x2c
and eax, 0xffffffdf
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x528], eax
add esi, 0xfffffff0
mov dword [ebp - 0x53c], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x484835
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx + 0xc]
push dword [ebx + 8]
push ecx
mov esi, esp
mov dword [ebp - 0x51c], esp
mov dword [ebp - 0x524], esi
mov eax, dword [edi]
sub eax, 0x10
push eax
call fcn.00425f70
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0x4d
mov eax, esp
push ebx
push dword [ebp - 0x520]
push eax
call fcn.00427170
mov ecx, dword [ebp - 0x518]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
call fcn.0048bc30
jmp 0x484c4e
push str._unregmso2pdfplugins
push dword [edi]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x484903
push str.office6ksomisc.exe
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x484903
push str.606_tKUninstall::ExecuteBeforeDeleteFiles_tUnRegistering_KMso2PdfPlugins.
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
push ebx
push dword [ebp - 0x520]
lea eax, [ebp - 0x5d0]
push eax
call fcn.00427170
push 0
push 1
push 0
push dword [ebx + 0xc]
mov dword [ebp - 4], 0x4e
push dword [ebx + 8]
push dword [edi]
push dword [eax]
call fcn.00474e60
mov edx, dword [ebp - 0x5d0]
jmp 0x4849f1
push str._unreghtml2PdfPlugins
push dword [edi]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x484979
push str.office6ksomisc.exe
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x484979
push str.612_tKUninstall::ExecuteBeforeDeleteFiles_tUnRegistering_KHtml2PdfPlugins.
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
push ebx
push dword [ebp - 0x520]
lea eax, [ebp - 0x5d4]
push eax
call fcn.00427170
push 0
push 1
push 0
push dword [ebx + 0xc]
mov dword [ebp - 4], 0x4f
push dword [ebx + 8]
push dword [edi]
push dword [eax]
call fcn.00474e60
mov edx, dword [ebp - 0x5d4]
jmp 0x4849f1
push str._delJsapiCert
push dword [edi]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x484a13
push str.office6ksomisc.exe
push dword [ebx]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x484a13
push str.618_tKUninstall::ExecuteBeforeDeleteFiles_tdelJsapiCert.
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
push ebx
push dword [ebp - 0x520]
lea eax, [ebp - 0x5d8]
push eax
call fcn.00427170
push 0
push 1
push 0
push dword [ebx + 0xc]
mov dword [ebp - 4], 0x50
push dword [ebx + 8]
push dword [edi]
push dword [eax]
call fcn.00474e60
mov edx, dword [ebp - 0x5d8]
add esp, 0x38
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x484a13
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x520]
mov dword [ebp - 4], 0x51
mov eax, dword [eax]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x484a32
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x484a46
call fcn.00421b80
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
test eax, eax
je 0x484cb5
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov ecx, dword [ebp - 0x520]
add eax, 0x10
mov dword [ebp - 0x584], eax
mov eax, dword [ebp - 0x528]
or eax, 0x80
mov ecx, dword [ecx]
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x53c], eax
mov eax, dword [ebx]
push dword [eax - 0xc]
push eax
push dword [ecx - 0xc]
lea eax, [ebp - 0x584]
push ecx
push eax
call fcn.00427890
push dword [edi]
mov esi, dword [ebp - 0x584]
push esi
push str.621_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov eax, dword [ebp - 0x528]
add esp, 0x2c
and eax, 0xffffff7f
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x528], eax
add esi, 0xfffffff0
mov dword [ebp - 0x53c], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x484ae6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x544], 0
je 0x484ba0
mov eax, dword [ebp - 0x518]
cmp dword [eax + 0xe0], 0
je 0x484ba0
cmp dword [ebx + 0x10], 0
jne 0x484ba0
push ebx
push dword [ebp - 0x520]
lea eax, [ebp - 0x5f8]
push eax
call fcn.00427170
push dword [edi]
mov dword [ebp - 4], 0x52
push dword [eax]
push str.624_tKUninstall::ExecuteBeforeDeleteFiles_tSendMsgToRunProcess:_ws__params_ws
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov edx, dword [ebp - 0x5f8]
add esp, 0x24
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x484b6f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx + 0xc]
push dword [ebx + 8]
push ecx
mov esi, esp
mov dword [ebp - 0x51c], esp
mov dword [ebp - 0x524], esi
mov eax, dword [edi]
sub eax, 0x10
push eax
call fcn.00425f70
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0x53
jmp 0x484861
mov esi, dword [ebp - 0x520]
lea eax, [ebp - 0x5e0]
push ebx
push esi
push eax
call fcn.00427170
push dword [edi]
mov dword [ebp - 4], 0x54
push dword [eax]
push str.629_tKUninstall::ExecuteBeforeDeleteFiles_tRunApp:_ws__params_ws
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov edx, dword [ebp - 0x5e0]
add esp, 0x24
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x484c00
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ebx
lea eax, [ebp - 0x594]
push esi
push eax
call fcn.00427170
push 0
push 1
push 0
push dword [ebx + 0xc]
mov dword [ebp - 4], 0x55
push dword [ebx + 8]
push dword [edi]
push dword [eax]
call fcn.00474e60
mov edx, dword [ebp - 0x594]
add esp, 0x28
or eax, 0xffffffff
add edx, 0xfffffff0
mov dword [ebp - 4], eax
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x484c4e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x540]
mov esi, dword [ebp - 0x538]
mov eax, dword [ebp - 0x518]
mov esi, dword [esi]
mov dword [ebp - 0x538], esi
cmp esi, dword [eax + 0x84]
je 0x484c81
mov ecx, dword [ebp - 0x588]
mov edx, dword [ebp - 0x58c]
jmp 0x482280
call fcn.0043c120
test eax, eax
je 0x484c8f
call fcn.004597d0
call fcn.00434b30
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053d079
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00425f50
call fcn.004264f0
push 0x80070057
call fcn.00425f50
call fcn.0054b0c3
int3