Function at 0x487f71
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
call fcn.004921d0
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x260]
push eax
push str.vtime
push str.SoftwareKingsoftKBROWSER
push SysReAllocStringLen
mov dword [ebp - 0x25c], 0x208
mov dword [ebp - 0x260], 1
call ebx
cmp word [ebp - 0x20c], 0
je 0x488033
lea eax, [ebp - 0x20c]
push eax
call fcn.00492c9a
push 0
mov esi, eax
call fcn.0049297d
pop ecx
mov dword [ebp - 0x258], eax
pop ecx
mov ecx, edx
lea eax, [esi + 0x15180]
cdq
cmp edx, ecx
jl 0x488033
jg 0x488027
cmp eax, dword [ebp - 0x258]
jbe 0x488033
push edi
call fcn.00488288
pop ecx
jmp 0x488279
push 0
call fcn.0049297d
push edx
push eax
lea eax, [ebp - 0x20c]
push 0x4c7a88
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x254]
call fcn.0040513a
cmp dword [ebp - 0x240], 8
mov eax, dword [ebp - 0x244]
lea ecx, [ebp - 0x254]
cmovae ecx, dword [ebp - 0x254]
add eax, eax
push eax
push ecx
push 1
push str.vtime
mov esi, str.SoftwareKingsoftKBROWSER
push esi
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x260]
push eax
push 0x4c198c
push esi
push SysReAllocStringLen
call ebx
cmp word [ebp - 0x20c], 0
jne 0x488115
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x260]
push eax
push 0x4c198c
push str.SOFTWAREliebao
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
cmp word [ebp - 0x20c], 0
jne 0x488115
push edi
call fcn.00488288
pop ecx
mov esi, eax
jmp 0x488268
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x23c]
call fcn.0040513a
call fcn.00487c66
push eax
lea ecx, [ebp - 0x23c]
call fcn.00409665
test eax, eax
je 0x488250
call fcn.00487c66
lea ecx, [ebp - 0x23c]
cmp ecx, eax
je 0x488159
push 0xffffffffffffffff
push 0
push eax
call fcn.00405a06
and dword [ebp - 0x214], 0
xor eax, eax
mov word [ebp - 0x224], ax
lea eax, [ebp - 0x258]
push eax
mov dword [ebp - 0x210], 7
call fcn.0048777a
mov esi, dword [ebp - 0x258]
pop ecx
cmp dword [esi - 4], 1
mov ebx, dword [esi - 0xc]
jle 0x4881a1
push ebx
lea ecx, [ebp - 0x258]
call fcn.00404d60
mov esi, dword [ebp - 0x258]
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00495430
lea eax, [ebp - 0x20c]
push eax
call fcn.00405113
add esp, 0x10
lea ecx, [ebp - 0x224]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0040509a
cmp dword [ebp - 0x228], 8
mov eax, dword [ebp - 0x22c]
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp - 0x23c]
cmovae ecx, dword [ebp - 0x23c]
add eax, eax
push eax
push ecx
push 1
push 0x4c198c
push str.SoftwareKingsoftKBROWSER
push SysReAllocStringLen
call ebx
cmp dword [ebp - 0x210], 8
mov eax, dword [ebp - 0x214]
lea ecx, [ebp - 0x224]
cmovae ecx, dword [ebp - 0x224]
add eax, eax
push eax
push ecx
push 1
push 0x4c1984
push str.SoftwareKingsoftKBROWSER
push SysReAllocStringLen
call ebx
lea ecx, [esi - 0x10]
call fcn.00404f8d
push 0
push 1
lea ecx, [ebp - 0x224]
call fcn.00405ac5
push edi
call fcn.00488288
pop ecx
push 0
push 1
lea ecx, [ebp - 0x23c]
mov esi, eax
call fcn.00405ac5
push 0
push 1
lea ecx, [ebp - 0x254]
call fcn.00405ac5
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret