Function at 0x426fcd
Capabilities:
Persist via run registry key

Disassembly:
push esi
call fcn.00424fc4
call fcn.00425768
mov esi, 0x48c308
push esi
push dword [0x4c1a3c]
push dword [0x4bd7f0]
call fcn.0043e8e0
mov eax, dword [0x4c1a44]
add esp, 0xc
cmp dword [eax - 0xc], 0
je 0x42599e
push esi
push eax
push dword [0x4bd7fc]
call fcn.0043e8e0
add esp, 0xc
call fcn.0042498f
push 0x48f54c
push str.KeepMoreVersion
push dword [0x4bd7d8]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043d6c9
add esp, 0x10
xor eax, eax
inc eax
pop esi
ret
jmp 0x42595e
push 0x14
mov eax, 0x484549
call fcn.00468a6e
lea ecx, [ebp - 0x20]
call fcn.00426738
push dword [0x4bd7e4]
and dword [ebp - 4], 0
call fcn.0043e7f0
mov dword [esp], str.Addins
push dword [0x4bd7d0]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call fcn.0043d7b6
push str.etclassics
push dword [0x4bd808]
lea eax, [ebp - 0x10]
push eax
call fcn.0042bc31
push dword [eax]
mov byte [ebp - 4], 1
call fcn.0043e7f0
mov ecx, dword [ebp - 0x10]
add esp, 0x1c
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00417891
mov ebx, str.RestartAppInfo
push ebx
push dword [0x4bd818]
lea eax, [ebp - 0x14]
push eax
call fcn.0042bc31
mov eax, dword [eax]
mov edi, 0x48c308
push edi
push eax
mov byte [ebp - 4], 2
call fcn.0043e85a
mov ecx, dword [ebp - 0x14]
add esp, 0x14
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00417891
push ebx
push dword [0x4bd804]
lea eax, [ebp - 0x10]
push eax
call fcn.0042bc31
mov eax, dword [eax]
push edi
push eax
mov byte [ebp - 4], 3
call fcn.0043e85a
mov ecx, dword [ebp - 0x10]
add esp, 0x14
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00417891
push ebx
push dword [0x4bd810]
lea eax, [ebp - 0x14]
push eax
call fcn.0042bc31
mov eax, dword [eax]
push edi
push eax
mov byte [ebp - 4], 4
call fcn.0043e85a
mov ecx, dword [ebp - 0x14]
add esp, 0x14
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00417891
push edi
push dword [0x4bd7f0]
call fcn.0043e85a
push str.languages
push dword [0x4bd7d0]
push esi
call fcn.0043d822
push 0x48f5e8
push dword [0x4bd7d0]
push esi
call fcn.0043d7b6
call fcn.004259c5
call fcn.00425ac0
push 0x48f988
push dword [0x4bd7cc]
push esi
call fcn.0043d7b6
push str.wpsautoupdate
push dword [0x4bd830]
push esi
call fcn.0043d822
call fcn.00424b35
push esi
call fcn.00424c09
push esi
call fcn.00424e10
add esp, 0x40
push str.LibPath
push dword [0x4bd828]
lea eax, [ebp - 0x14]
push eax
call fcn.0042bc31
mov eax, dword [eax]
push edi
push eax
mov byte [ebp - 4], 5
call fcn.0043e85a
mov ecx, dword [ebp - 0x14]
add esp, 0x14
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00417891
push str.KeepMoreVersion
push dword [0x4bd7d8]
push esi
call fcn.0043d822
or dword [ebp - 4], 0xffffffff
add esp, 0xc
lea ecx, [ebp - 0x20]
call fcn.0042548b
xor eax, eax
inc eax
call fcn.00468b46
ret
jmp 0x42678a
test byte [0x4c1a28], 2
jne 0x426e99
call fcn.0042551a
cmp dword [0x4bd844], 0
je 0x426ebe
push esi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call fcn.0042695c
push esi
call fcn.004250e6
push esi
call fcn.00426a63
add esp, 0xc
pop esi
call fcn.00429718
test eax, eax
je 0x426ecc
call fcn.00425237
xor eax, eax
inc eax
ret
push 8
mov eax, 0x487d9e
call fcn.00468a6e
push str.office6_addonsqingqingbangong.dll
push dword [0x4c1a34]
lea eax, [ebp - 0x10]
push eax
call fcn.0042bc31
add esp, 0xc
and dword [ebp - 4], 0
cmp dword [0x4bd844], 0
je 0x426fb9
push str.LibPath
push dword [0x4bd828]
lea eax, [ebp - 0x14]
push eax
call fcn.0042bc31
mov eax, dword [eax]
push 0x48c308
push dword [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
call fcn.0043e8e0
mov ecx, dword [ebp - 0x14]
add esp, 0x18
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00417891
mov esi, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00426df9
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00417891
xor eax, eax
inc eax
call fcn.00468b46
ret
xor eax, eax
sub ecx, 0x65
je 0x426fec
dec ecx
je 0x426fe7
dec ecx
je 0x426fe2
dec ecx
jne 0x426ff1
jmp 0x426f45
jmp 0x426957
jmp 0x425ce6
jmp 0x426e8b
ret