Function at 0x497a30
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a5cb2
mov eax, dword fs:[0]
push eax
sub esp, 0x5ec
mov eax, dword [0x639354]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [0x6421fc], 0
je 0x497a9c
push 0
push 0
push 0x5ba110
push str.StepPreUninstallBegin
push 1
call fcn.004d4f50
add esp, 0x14
cmp byte [0x6421fc], 0
je 0x497a9c
push 0xff
push str.StepPreUninstallBegin
call fcn.004d4fd0
add esp, 8
mov dword [ebp - 4], 0
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4990dd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x5c4], eax
mov dword [ebp - 4], 2
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4990dd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x580], eax
mov byte [ebp - 4], 4
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4990dd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x56c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov byte [ebp - 4], 6
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4990dd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x57c], eax
push 0x208
lea eax, [ebp - 0x234]
push 0
push eax
call fcn.00560a80
add esp, 0xc
mov byte [ebp - 4], 8
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4990dd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x578], eax
mov byte [ebp - 4], 0xa
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4990dd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x574], eax
lea eax, [ebp - 0x5c8]
mov byte [ebp - 4], 0xb
push eax
mov ecx, edi
call fcn.00495190
lea ecx, [ebp - 0x5f8]
mov byte [ebp - 4], 0xc
call fcn.004d26b0
mov byte [ebp - 4], 0xd
call fcn.0047de00
mov dword [ebp - 0x5c0], eax
test eax, eax
je 0x497bec
cmp dword [edi + 0x20], 0
jne 0x497bec
push str.1365_tKUninstall::RealUninstallFunc_tis_Hp_preInstall_and_not_save_UserInfo
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
add esp, 0x10
lea eax, [edi + 0x10]
lea ecx, [ebp - 0x5f8]
push eax
call fcn.004d3f50
mov byte [ebp - 4], 0xe
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4990dd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x568], eax
lea eax, [ebp - 0x594]
mov byte [ebp - 4], 0x10
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x20019
push 0
push dword [0x6134a0]
mov dword [ebp - 0x594], 0
push 0x80000002
mov dword [ebp - 0x5e4], eax
call eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x5e8], ebx
test eax, eax
jne 0x497d3e
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x564], 0
test eax, eax
je 0x497d3e
lea ecx, [ebp - 0x564]
push ecx
push 0
lea ecx, [ebp - 0x560]
push ecx
push 0
push str.DistSrc
push eax
call ebx
mov eax, dword [ebp - 0x560]
cmp eax, 1
je 0x497c9b
cmp eax, 2
jne 0x497d3e
lea ecx, [ebp - 0x568]
call fcn.00429c20
mov edx, dword [ebp - 0x564]
shr edx, 1
add edx, 1
js 0x4990f1
mov esi, dword [ebp - 0x568]
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x497ce0
push edx
lea ecx, [ebp - 0x568]
call fcn.00429eb0
mov esi, dword [ebp - 0x568]
lea eax, [ebp - 0x564]
push eax
push esi
lea eax, [ebp - 0x560]
push eax
push 0
push str.DistSrc
push dword [ebp - 0x594]
call ebx
test eax, eax
jne 0x497d3e
mov eax, dword [ebp - 0x564]
xor ecx, ecx
shr eax, 1
mov word [esi + eax*2], cx
test esi, esi
jne 0x497d18
xor eax, eax
jmp 0x497d2c
push dword [esi - 8]
push esi
call fcn.0056b163
add esp, 8
test eax, eax
js 0x4990f1
cmp eax, dword [esi - 8]
jg 0x4990f1
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea ecx, [ebp - 0x55c]
call fcn.004c02e0
mov byte [ebp - 4], 0x11
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x4990e7
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x564], eax
mov eax, 0x5c59bc
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x564]
test eax, 0xffff0000
jne 0x497d8b
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x497d97
push 1
push 0x5c59bc
call fcn.0042a060
lea eax, [ebp - 0x484]
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0x55c]
call fcn.004c0fb0
mov edx, eax
cmp dword [edx + 0x14], 8
mov byte [ebp - 4], 0x14
jb 0x497dbb
mov edx, dword [edx]
test edx, edx
jne 0x497dc3
xor ecx, ecx
jmp 0x497ddf
mov ecx, edx
lea esi, [ecx + 2]
jmp 0x497dd0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x497dd0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x564]
call fcn.004299d0
mov edx, dword [ebp - 0x470]
mov byte [ebp - 4], 0x13
cmp edx, 8
jb 0x497e30
mov ecx, dword [ebp - 0x484]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x497e26
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4990fb
push edx
push ecx
call fcn.0055c524
add esp, 8
push 1
push 0x5c59c0
lea ecx, [ebp - 0x564]
call fcn.004299d0
mov eax, dword [0x613468]
or ebx, 0xffffffff
mov dword [ebp - 0x560], eax
mov eax, dword [edi + 0x50]
mov dword [ebp - 0x5b8], eax
test eax, eax
je 0x497ee8
mov esi, dword [edi + 0x28]
lea ecx, [ebp - 0x588]
push str.Preparing_to_uninstall
call fcn.004444c0
lea eax, [ebp - 0x588]
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp - 0x598]
mov ecx, 0x642094
push eax
call fcn.004c4d90
push esi
push dword [eax]
mov byte [ebp - 4], 0x16
push 0
push 0
push dword [ebp - 0x560]
call dword [ebp - 0x5b8]
mov edx, dword [ebp - 0x598]
add esp, 0x14
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x497ec7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x588]
mov eax, ebx
mov byte [ebp - 4], 0x13
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x497ee8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi + 0xfc]
cmp dword [eax - 0xc], 0
je 0x4980e4
lea eax, [edi + 0x10]
push eax
lea eax, [ebp - 0x49c]
push eax
call fcn.004a0850
add esp, 8
mov dword [ebp - 0x5b8], eax
mov edx, dword [edi + 0x100]
mov byte [ebp - 4], 0x17
cmp dword [edx - 4], 1
jle 0x497f35
push dword [edx - 0xc]
lea ecx, [edi + 0x100]
call fcn.00429cd0
mov edx, dword [edi + 0x100]
mov ecx, edx
mov dword [ebp - 0x454], 0
xor eax, eax
mov dword [ebp - 0x444], 0
mov word [ebp - 0x454], ax
mov dword [ebp - 0x440], 7
lea eax, [ecx + 2]
mov dword [ebp - 0x598], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x497f67
sub ecx, dword [ebp - 0x598]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x454]
call fcn.0042e330
mov edx, dword [edi + 0xfc]
mov byte [ebp - 4], 0x18
cmp dword [edx - 4], 1
jle 0x497fab
push dword [edx - 0xc]
lea ecx, [edi + 0xfc]
call fcn.00429cd0
mov edx, dword [edi + 0xfc]
mov ecx, edx
mov dword [ebp - 0x46c], 0
xor eax, eax
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 7
mov word [ebp - 0x46c], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x497fd7
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x46c]
call fcn.0042e330
push dword [ebp - 0x5b8]
lea eax, [ebp - 0x454]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x46c]
push eax
call fcn.004b9240
mov edx, dword [ebp - 0x458]
add esp, 0xc
mov byte [ebp - 4], 0x18
cmp edx, 8
jb 0x498057
mov ecx, dword [ebp - 0x46c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x49804d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x499100
push edx
push ecx
call fcn.0055c524
add esp, 8
mov edx, dword [ebp - 0x440]
xor eax, eax
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 7
mov word [ebp - 0x46c], ax
mov byte [ebp - 4], 0x17
cmp edx, 8
jb 0x4980b8
mov ecx, dword [ebp - 0x454]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4980ae
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x499100
push edx
push ecx
call fcn.0055c524
add esp, 8
xor eax, eax
mov dword [ebp - 0x444], 0
lea ecx, [ebp - 0x49c]
mov dword [ebp - 0x440], 7
mov word [ebp - 0x454], ax
mov byte [ebp - 4], 0x13
call fcn.0042ab30
cmp dword [edi + 0xdc], 0
mov ecx, edi
je 0x49812e
lea eax, [ebp - 0x5ac]
push eax
call fcn.00494e40
push eax
lea ecx, [edi + 0xc4]
mov byte [ebp - 4], 0x1a
call fcn.004297a0
mov edx, dword [ebp - 0x5ac]
mov eax, ebx
mov byte [ebp - 4], 0x13
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x498133
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x498133
call fcn.0049e390
mov eax, dword [edi + 0x10]
sub eax, 0x10
push eax
call fcn.00429b80
add eax, 0x10
mov dword [ebp - 0x570], eax
lea eax, [ebp - 0x570]
mov byte [ebp - 4], 0x1b
push eax
call fcn.0047fa90
add esp, 8
lea ecx, [ebp - 0x570]
push 0x13
push str.utilityinstall.ini
call fcn.004299d0
push dword [ebp - 0x570]
xor eax, eax
push 0xa
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x5bd654
push str.InstallPerUser
push str.update
mov dword [ebp - 0x560], eax
call eax
lea eax, [ebp - 0x2c]
push 0x5bb494
push eax
call fcn.0056b422
add esp, 8
neg eax
sbb eax, eax
inc eax
mov dword [edi + 0xe0], eax
push dword [ebp - 0x570]
push 0x5bd654
push str.needAdmin
push str.update
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [edi + 0x10]
lea ecx, [ebp - 0x5c4]
mov dword [ebp - 0x598], eax
call fcn.00476860
test eax, eax
je 0x498c87
mov dword [edi + 8], 0
cmp byte [0x6421fc], 0
je 0x498242
push 0
push 0
push 0x5ba110
push str.StepPreUninstallBegin
push 1
call fcn.004d4f90
add esp, 0x14
cmp byte [0x6421fc], 0
je 0x498242
push 0xff
push str.StepPreUninstallBegin
call fcn.004d4ff0
add esp, 8
push str.1411_tKUninstall::RealUninstallFunc_tuninstall_begin...
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov eax, dword [str._FPcd]
add esp, 0x10
mov dword [ebp - 0x588], eax
mov eax, dword [edi + 0x50]
mov dword [ebp - 0x5ac], eax
test eax, eax
je 0x498301
mov esi, dword [edi + 0x28]
lea ecx, [ebp - 0x5bc]
push str.Performing_the_preparation_before_uninstallation
call fcn.004444c0
lea eax, [ebp - 0x5bc]
mov byte [ebp - 4], 0x1c
push eax
lea eax, [ebp - 0x59c]
mov ecx, 0x642094
push eax
call fcn.004c4d90
push esi
push dword [eax]
mov byte [ebp - 4], 0x1d
push 0
push 1
push dword [ebp - 0x588]
call dword [ebp - 0x5ac]
mov edx, dword [ebp - 0x59c]
add esp, 0x14
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4982e0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5bc]
mov eax, ebx
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x498301
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [0x6421fc], 0
je 0x49833d
push 0
push 0
push 0x5ba110
push str.StepExecBeforeDeleteFile
push 1
call fcn.004d4f50
add esp, 0x14
cmp byte [0x6421fc], 0
je 0x49833d
push 0xff
push str.StepExecBeforeDeleteFile
call fcn.004d4fd0
add esp, 8
mov ecx, edi
call fcn.00491c30
cmp byte [0x6421fc], 0
mov esi, eax
je 0x498382
push 0
push 0
push 0x5ba110
push str.StepExecBeforeDeleteFile
push 1
call fcn.004d4f90
add esp, 0x14
cmp byte [0x6421fc], 0
je 0x498382
push 0xff
push str.StepExecBeforeDeleteFile
call fcn.004d4ff0
add esp, 8
test esi, esi
jne 0x498422
mov eax, dword [edi + 0x50]
mov dword [ebp - 0x59c], eax
test eax, eax
je 0x498422
mov esi, dword [edi + 0x28]
lea ecx, [ebp - 0x5dc]
push str.Failed_to_perform_the_preparation_before_uninstallation
call fcn.004444c0
lea eax, [ebp - 0x5dc]
mov byte [ebp - 4], 0x1e
push eax
lea eax, [ebp - 0x5a0]
mov ecx, 0x642094
push eax
call fcn.004c4d90
push esi
push dword [eax]
mov byte [ebp - 4], 0x1f
push 2
push 1
push dword [ebp - 0x588]
call dword [ebp - 0x59c]
mov edx, dword [ebp - 0x5a0]
add esp, 0x14
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x498401
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5dc]
mov eax, ebx
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x498422
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x613470]
mov dword [ebp - 0x5a0], eax
mov eax, dword [edi + 0x50]
mov dword [ebp - 0x59c], eax
test eax, eax
je 0x4984c5
mov esi, dword [edi + 0x28]
lea ecx, [ebp - 0x5d8]
push str.Deleting_files
call fcn.004444c0
lea eax, [ebp - 0x5d8]
mov byte [ebp - 4], 0x20
push eax
lea eax, [ebp - 0x5b4]
mov ecx, 0x642094
push eax
call fcn.004c4d90
push esi
push dword [eax]
mov byte [ebp - 4], 0x21
push 0
push 2
push dword [ebp - 0x5a0]
call dword [ebp - 0x59c]
mov edx, dword [ebp - 0x5b4]
add esp, 0x14
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4984a4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5d8]
mov eax, ebx
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4984c5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea esi, [edi + 0x10]
push esi
lea ecx, [ebp - 0x56c]
call fcn.004297a0
lea eax, [ebp - 0x56c]
push eax
call fcn.0047fa90
add esp, 4
lea ecx, [ebp - 0x56c]
push 0x13
push str.office6KsoPost.exe
call fcn.004299d0
lea eax, [ebp - 0x574]
mov ecx, edi
push eax
call fcn.0049e700
push 0xb
push str.KsoPost.exe
lea ecx, [ebp - 0x574]
call fcn.004299d0
push dword [ebp - 0x56c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x498539
push 0
push dword [ebp - 0x574]
push dword [ebp - 0x56c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
lea ecx, [ebp - 0x57c]
call fcn.004297a0
lea eax, [ebp - 0x57c]
push eax
call fcn.0047fa90
add esp, 4
lea ecx, [ebp - 0x57c]
push 0x13
push str.utilityinstall.ini
call fcn.004299d0
push dword [ebp - 0x57c]
lea eax, [ebp - 0x18]
push 3
push eax
push 0x5b9868
push str.withKsoPost
push str.installinfo
call dword [ebp - 0x560]
push esi
lea ecx, [ebp - 0x578]
call fcn.004297a0
lea eax, [ebp - 0x578]
push eax
call fcn.0047fa90
add esp, 4
lea ecx, [ebp - 0x578]
push 0x16
push str.office6cfgs_setup.cfg
call fcn.004299d0
push dword [ebp - 0x578]
lea eax, [ebp - 0x234]
push 0x104
push eax
push 0x5b8734
push str.Version
push 0x5c5b78
call dword [ebp - 0x560]
push 0
call fcn.0047adc0
add esp, 4
cmp byte [0x6421fc], 0
je 0x498621
push 0
push 0
push 0x5ba110
push str.StepDeleteFile
push 1
call fcn.004d4f50
add esp, 0x14
cmp byte [0x6421fc], 0
je 0x498621
push 0xff
push str.StepDeleteFile
call fcn.004d4fd0
add esp, 8
mov ecx, edi
call fcn.0048fa80
mov ecx, edi
call fcn.0048caf0
mov eax, dword [0x613474]
mov dword [ebp - 0x5b4], eax
mov eax, dword [edi + 0x50]
mov dword [ebp - 0x5a0], eax
test eax, eax
je 0x4986d2
mov esi, dword [edi + 0x28]
lea ecx, [ebp - 0x5d4]
push str.Deleting_files
call fcn.004444c0
lea eax, [ebp - 0x5d4]
mov byte [ebp - 4], 0x22
push eax
lea eax, [ebp - 0x5e0]
mov ecx, 0x642094
push eax
call fcn.004c4d90
push esi
push dword [eax]
mov byte [ebp - 4], 0x23
push 0
push 3
push dword [ebp - 0x5b4]
call dword [ebp - 0x5a0]
mov edx, dword [ebp - 0x5e0]
add esp, 0x14
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4986b1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5d4]
mov eax, ebx
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4986d2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, edi
call fcn.00490690
push str.1462_tKUninstall::RealUninstallFunc_tstart_delete_old_version_product
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
add esp, 0x10
cmp dword [edi + 0xdc], 0
je 0x498712
lea eax, [edi + 0xc4]
push eax
lea ecx, [ebp - 0x580]
call fcn.004297a0
jmp 0x498751
lea eax, [ebp - 0x584]
mov ecx, edi
push eax
call fcn.004975b0
push eax
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], 0x24
call fcn.004297a0
mov edx, dword [ebp - 0x584]
mov eax, ebx
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x498751
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov esi, esp
mov dword [ebp - 0x584], esi
mov eax, dword [ebp - 0x580]
add eax, 0xfffffff0
push eax
call fcn.00429b80
add esp, 4
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.0048c460
cmp byte [0x6421fc], 0
je 0x4987b4
push 0
push 0
push 0x5ba110
push str.StepDeleteFile
push 1
call fcn.004d4f90
add esp, 0x14
cmp byte [0x6421fc], 0
je 0x4987b4
push 0xff
push str.StepDeleteFile
call fcn.004d4ff0
add esp, 8
push dword [ebp - 0x580]
push str.1473_tKUninstall::RealUninstallFunc_tend_delete_old_version__ws__product
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
push 1
call fcn.0047adc0
add esp, 0x18
lea ecx, [edi + 0x2c]
call fcn.00487b40
push str.office6werhandler.dll
lea eax, [edi + 0x10]
push eax
lea eax, [ebp - 0x58c]
push eax
call fcn.00429810
push dword [eax]
mov byte [ebp - 4], 0x25
call fcn.004493a0
mov edx, dword [ebp - 0x58c]
add esp, 0x10
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x498829
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x613478]
mov dword [ebp - 0x58c], eax
mov eax, dword [edi + 0x50]
mov dword [ebp - 0x584], eax
test eax, eax
je 0x4988cc
mov esi, dword [edi + 0x28]
lea ecx, [ebp - 0x590]
push str.Unregistering
call fcn.004444c0
lea eax, [ebp - 0x590]
mov byte [ebp - 4], 0x26
push eax
lea eax, [ebp - 0x5a8]
mov ecx, 0x642094
push eax
call fcn.004c4d90
push esi
push dword [eax]
mov byte [ebp - 4], 0x27
push 0
push 4
push dword [ebp - 0x58c]
call dword [ebp - 0x584]
mov edx, dword [ebp - 0x5a8]
add esp, 0x14
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4988ab
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x590]
mov eax, ebx
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4988cc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [edi + 4], 0
jne 0x498a1e
mov ecx, 0x5bbd7c
lea eax, [ebp - 0x18]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x498906
test dx, dx
je 0x498902
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x498906
add eax, 4
add ecx, 4
test dx, dx
jne 0x4988e0
xor eax, eax
jmp 0x49890b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x498a1e
call fcn.00441be0
test eax, eax
je 0x498934
push 1
push str.WithKsoPost
call fcn.00460c60
add esp, 8
cmp eax, 1
jne 0x498a1e
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x499105
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x560], eax
mov eax, str._u__GUID___p__PipeName___n_kso__v__InstalledBuildVersion___r_0__i_0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x560]
test eax, 0xffff0000
jne 0x498972
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x49897e
push 0x43
push str._u__GUID___p__PipeName___n_kso__v__InstalledBuildVersion___r_0__i_0
call fcn.0042a060
push dword [ebp - 0x564]
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 0x29
push str._GUID_
call fcn.00463440
lea eax, [ebp - 0x234]
push eax
push str._InstalledBuildVersion_
lea ecx, [ebp - 0x560]
call fcn.00463440
mov eax, dword [ebp - 0x568]
cmp dword [eax - 0xc], 0
jne 0x4989d3
push 0xe
push str.00001.00000002
lea ecx, [ebp - 0x568]
call fcn.0042a060
mov eax, dword [ebp - 0x568]
push eax
push str._PipeName_
lea ecx, [ebp - 0x560]
call fcn.00463440
mov esi, dword [ebp - 0x560]
push 0
push 1
push 0
push 1
push 0
push esi
push dword [ebp - 0x574]
call fcn.0047fdb0
add esp, 0x1c
mov byte [ebp - 4], 0x1b
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x498a1e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [0x6421fc], 0
je 0x498a5a
push 0
push 0
push 0x5ba110
push str.StepDeregister
push 1
call fcn.004d4f50
add esp, 0x14
cmp byte [0x6421fc], 0
je 0x498a5a
push 0xff
push str.StepDeregister
call fcn.004d4fd0
add esp, 8
xor esi, esi
mov dword [ebp - 0x5a8], esi
push str.1229_tKUninstall::Deregister_tRunApp_Deregister_...
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
mov byte [ebp - 4], 0x2a
call fcn.0046b730
add esp, 0x10
cmp byte [0x6421fc], 0
je 0x498abc
push esi
push esi
push 0x5ba110
push str.StepDeregisterUninstall
push 1
call fcn.004d4f50
add esp, 0x14
cmp byte [0x6421fc], 0
je 0x498abc
push 0xff
push str.StepDeregisterUninstall
call fcn.004d4fd0
add esp, 8
mov ecx, edi
call fcn.00499c20
cmp byte [0x6421fc], 0
mov dword [ebp - 0x590], eax
je 0x498b05
push 0
push 0
push 0x5ba110
push str.StepDeregisterUninstall
push 1
call fcn.004d4f90
add esp, 0x14
cmp byte [0x6421fc], 0
je 0x498b05
push 0xff
push str.StepDeregisterUninstall
call fcn.004d4ff0
add esp, 8
push dword [ebp - 0x590]
push str.1234_tKUninstall::Deregister_tRunApp_Deregister_return:_d
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
cmp dword [ebp - 0x590], 0
mov eax, 1
cmovne esi, eax
push esi
push str.1241_tKUninstall::Deregister_tKInsall::Deregister_return:_d
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
add esp, 0x28
mov byte [ebp - 4], 0x1b
cmp byte [0x6421fc], 0
je 0x498b90
push 0
push 0
push 0x5ba110
push str.StepDeregister
push 1
call fcn.004d4f90
add esp, 0x14
cmp byte [0x6421fc], 0
je 0x498b90
push 0xff
push str.StepDeregister
call fcn.004d4ff0
add esp, 8
call fcn.00441c30
mov esi, dword [ebp - 0x5c0]
test eax, eax
je 0x498bb1
test esi, esi
jne 0x498bb1
lea eax, [ebp - 0x5c8]
mov ecx, edi
push eax
call fcn.00496d40
cmp byte [0x6421fc], 0
je 0x498bed
push 0
push 0
push 0x5ba110
push str.StepEndUninstall
push 1
call fcn.004d4f50
add esp, 0x14
cmp byte [0x6421fc], 0
je 0x498bed
push 0xff
push str.StepEndUninstall
call fcn.004d4fd0
add esp, 8
mov ecx, edi
call fcn.0048b7a0
mov ecx, edi
call fcn.0048a6e0
mov ecx, edi
call fcn.0048a0e0
push 0
call fcn.004a0d20
push eax
mov ecx, edi
call fcn.0048a2d0
test al, al
jne 0x498c1c
push str.2366_tKUninstall::CleanQmlCache_tclean_Qml_Cache_by_recursion_failed
jmp 0x498c38
call fcn.004a0d20
push 1
push 0
push dword [eax]
call fcn.0047fb80
add esp, 0xc
test eax, eax
jne 0x498c4f
push str.2372_tKUninstall::CleanQmlCache_tremove_empty_folder_failed
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._ERROR_
push 0x641cc8
call fcn.0046b730
add esp, 0x10
test esi, esi
je 0x498c80
cmp dword [edi + 0x20], 0
jne 0x498c80
push str.1519_tKUninstall::RealUninstallFunc_tExecute_remanence_cleanup_program
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
add esp, 0x10
lea ecx, [ebp - 0x5f8]
call fcn.004d29b0
mov dword [edi + 8], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x598]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi + 0x4c], eax
mov eax, dword [0x61347c]
mov dword [ebp - 0x5a8], eax
mov eax, dword [edi + 0x50]
mov dword [ebp - 0x58c], eax
test eax, eax
je 0x498ecd
cmp dword [edi + 8], 0
je 0x498ecd
mov esi, dword [edi + 0x28]
lea ecx, [ebp - 0x5d0]
push str.Uninstallation_completed
call fcn.004444c0
lea eax, [ebp - 0x5d0]
mov byte [ebp - 4], 0x2b
push eax
lea eax, [ebp - 0x5b0]
mov ecx, 0x642094
push eax
call fcn.004c4d90
push esi
push dword [eax]
mov byte [ebp - 4], 0x2c
push 0
push 5
push dword [ebp - 0x5a8]
call dword [ebp - 0x58c]
mov edx, dword [ebp - 0x5b0]
add esp, 0x14
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x498d28
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5d0]
mov eax, ebx
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x498d49
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [edi + 0xd0]
call fcn.0051d5c0
add esp, 4
test eax, eax
jne 0x498ec7
lea eax, [ebp - 0x5cc]
mov dword [ebp - 0x5b0], 0x104
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push 0x80000002
call dword [ebp - 0x5e4]
test eax, eax
jne 0x498eab
lea eax, [ebp - 0x5b0]
push eax
lea eax, [ebp - 0x43c]
push eax
push 0
push 0
push str.Path
push dword [ebp - 0x5cc]
call dword [ebp - 0x5e8]
test eax, eax
jne 0x498e7f
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x5a4]
call fcn.004445b0
push 0xd
push str.iexplore.exe
lea ecx, [ebp - 0x5a4]
mov byte [ebp - 4], 0x2d
call fcn.004299d0
push dword [edi + 0xd0]
call fcn.0051f420
add esp, 4
test eax, eax
je 0x498e44
push dword [ebp - 0x5a4]
call fcn.0051f2a0
add esp, 4
test eax, eax
je 0x498e44
push 1
push 0
push dword [edi + 0xd0]
push dword [ebp - 0x5a4]
push str.open
push 0
call fcn.00521b10
add esp, 0x18
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x5a4]
call fcn.004296c0
push dword [ebp - 0x5cc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
jmp 0x498ecd
push str.1553_tKUninstall::RealUninstallFunc_tm_strUninstallSurveyUrl_checkUrl_Fail_or_iexplorePath_checkLocalFileSafe_Fail_
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._ERROR_
push 0x641cc8
call fcn.0046b730
add esp, 0x10
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x5a4]
call fcn.004296c0
push dword [ebp - 0x5cc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
jmp 0x498ecd
push str.1558_tKUninstall::RealUninstallFunc_tUnable_to_read_IEXPLORE.EXE_registry_value
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._ERROR_
push 0x641cc8
call fcn.0046b730
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x10
push dword [ebp - 0x5cc]
call esi
jmp 0x498ecd
push str.1564_tKUninstall::RealUninstallFunc_tUnable_to_open_IEXPLORE.EXE_registry_key_so_unable_to_open_URL_through_iexplore.exe
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._ERROR_
push 0x641cc8
call fcn.0046b730
add esp, 0x10
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [edi + 0x48], 0
je 0x498f16
push str.1571_tKUninstall::RealUninstallFunc_twait_wpsmain
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
add esp, 0x10
push 0xffffffffffffffff
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.1573_tKUninstall::RealUninstallFunc_twait_wpsmain_end
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
add esp, 0x10
push dword [edi + 0x4c]
push dword [edi + 8]
push str.1576_tKUninstall::RealUninstallFunc_tuninstall_end__return:_d__install_cost_time:_dms
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
add esp, 0x18
cmp byte [0x6421fc], 0
je 0x498f74
push 0
push 0
push 0x5ba110
push str.StepEndUninstall
push 1
call fcn.004d4f90
add esp, 0x14
cmp byte [0x6421fc], 0
je 0x498f74
push 0xff
push str.StepEndUninstall
call fcn.004d4ff0
add esp, 8
mov edx, dword [ebp - 0x570]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x498f91
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x564]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x498fae
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x55c]
call fcn.00488f30
mov eax, dword [ebp - 0x594]
test eax, eax
je 0x498fc6
push eax
call esi
mov edx, dword [ebp - 0x568]
mov eax, ebx
mov dword [ebp - 0x594], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x498fed
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x5f8]
call fcn.004d27f0
mov edx, dword [ebp - 0x5c8]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x499015
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x574]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x499032
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x578]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49904f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x57c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49906c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x56c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x499089
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x580]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4990a6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5c4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4990c1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055c3a9
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80070057
call fcn.00429b60
call fcn.0056af64
call fcn.0056af64
push 0x80004005
call fcn.00429b60
int3