Function at 0x4877a0
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Create process on windows
Query or enumerate registry value
Read .ini file
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59cc51
mov eax, dword fs:[0]
push eax
sub esp, 0x3a0
mov eax, dword [0x61ce74]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [0x62a1c4], 0
je 0x487809
push 0
push 0
push 0x5bed51
push str.StepPreUninstallBegin
push 1
call fcn.004c7f00
add esp, 0x14
cmp byte [0x62a1c4], 0
je 0x487809
push 0
push str.StepPreUninstallBegin
call fcn.004c7f80
add esp, 8
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x488af5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x394], eax
mov dword [ebp - 4], 0
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x488aff
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x364], eax
mov byte [ebp - 4], 1
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x488af5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x34c], eax
xor eax, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x488af5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x360], eax
push 0x208
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 3
push 0
push eax
call fcn.00540d70
add esp, 0xc
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x488af5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x35c], eax
mov byte [ebp - 4], 4
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x488af5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x358], eax
mov byte [ebp - 4], 5
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x488b09
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x348], eax
lea eax, [ebp - 0x354]
mov byte [ebp - 4], 7
push eax
push dword [0x61b7f0]
mov dword [ebp - 0x354], 0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x487a1f
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x354]
test eax, eax
je 0x487a1f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x340]
push ecx
push 0
lea ecx, [ebp - 0x344]
push ecx
push 0
push str.DistSrc
push eax
call ebx
mov eax, dword [ebp - 0x344]
cmp eax, 1
je 0x487984
cmp eax, 2
jne 0x487a1f
lea ecx, [ebp - 0x348]
call fcn.00426010
mov edx, dword [ebp - 0x340]
shr edx, 1
add edx, 1
js 0x488b1d
mov esi, dword [ebp - 0x348]
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x4879c9
push edx
lea ecx, [ebp - 0x348]
call fcn.00426250
mov esi, dword [ebp - 0x348]
lea eax, [ebp - 0x340]
push eax
push esi
lea eax, [ebp - 0x344]
push eax
push 0
push str.DistSrc
push dword [ebp - 0x354]
call ebx
test eax, eax
jne 0x487a1f
mov eax, dword [ebp - 0x340]
xor ecx, ecx
shr eax, 1
mov word [esi + eax*2], cx
push dword [esi - 8]
push esi
call fcn.0054b2c2
add esp, 8
test eax, eax
js 0x488b1d
cmp eax, dword [esi - 8]
jg 0x488b1d
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea ecx, [ebp - 0x33c]
call fcn.004a8a40
mov byte [ebp - 4], 8
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x488b13
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x340], eax
mov eax, 0x5c346c
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x340]
test eax, 0xffff0000
jne 0x487a6c
movzx eax, ax
push eax
call fcn.00426130
jmp 0x487a78
push 1
push 0x5c346c
call fcn.004263f0
lea eax, [ebp - 0x27c]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x33c]
call fcn.004a95f0
mov edx, eax
cmp dword [edx + 0x14], 8
mov byte [ebp - 4], 0xb
jb 0x487a9c
mov edx, dword [edx]
test edx, edx
jne 0x487aa4
xor ecx, ecx
jmp 0x487abf
mov ecx, edx
lea esi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x487ab0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x340]
call fcn.00425dc0
mov edx, dword [ebp - 0x268]
mov byte [ebp - 4], 0xa
cmp edx, 8
jb 0x487b10
mov ecx, dword [ebp - 0x27c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x487b06
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x488b27
push edx
push ecx
call fcn.0053d0af
add esp, 8
push 1
push 0x5c3470
lea ecx, [ebp - 0x340]
call fcn.00425dc0
mov esi, dword [0x61b7b8]
or ebx, 0xffffffff
cmp dword [edi + 0x50], 0
je 0x487bb9
push str.Preparing_to_uninstall
lea ecx, [ebp - 0x368]
call fcn.0043f4e0
lea eax, [ebp - 0x368]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x36c]
mov ecx, 0x629f1c
push eax
call fcn.004ad020
push dword [edi + 0x28]
mov byte [ebp - 4], 0xd
push dword [eax]
mov eax, dword [edi + 0x50]
push 0
push 0
push esi
call eax
mov edx, dword [ebp - 0x36c]
add esp, 0x14
mov byte [ebp - 4], 0xc
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x487b98
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x368]
mov eax, ebx
mov byte [ebp - 4], 0xa
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x487bb9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi + 0xf8]
cmp dword [eax - 0xc], 0
je 0x487d52
mov edx, dword [edi + 0xfc]
cmp dword [edx - 4], 1
jle 0x487be9
push dword [edx - 0xc]
lea ecx, [edi + 0xfc]
call fcn.00426070
mov edx, dword [edi + 0xfc]
mov ecx, edx
mov dword [ebp - 0x254], 0
xor eax, eax
mov dword [ebp - 0x250], 7
mov word [ebp - 0x264], ax
lea eax, [ecx + 2]
mov dword [ebp - 0x36c], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x487c11
sub ecx, dword [ebp - 0x36c]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x264]
call fcn.00439df0
mov edx, dword [edi + 0xf8]
mov byte [ebp - 4], 0xe
cmp dword [edx - 4], 1
jle 0x487c55
push dword [edx - 0xc]
lea ecx, [edi + 0xf8]
call fcn.00426070
mov edx, dword [edi + 0xf8]
mov ecx, edx
mov dword [ebp - 0x23c], 0
xor eax, eax
mov dword [ebp - 0x238], 7
mov word [ebp - 0x24c], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x487c77
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x24c]
call fcn.00439df0
lea eax, [ebp - 0x264]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.004a3080
mov edx, dword [ebp - 0x238]
add esp, 8
mov byte [ebp - 4], 0xe
cmp edx, 8
jb 0x487cf1
mov ecx, dword [ebp - 0x24c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x487ce7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x488b2c
push edx
push ecx
call fcn.0053d0af
add esp, 8
mov edx, dword [ebp - 0x250]
xor eax, eax
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 7
mov word [ebp - 0x24c], ax
mov byte [ebp - 4], 0xa
cmp edx, 8
jb 0x487d52
mov ecx, dword [ebp - 0x264]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x487d48
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x488b2c
push edx
push ecx
call fcn.0053d0af
add esp, 8
cmp dword [edi + 0xdc], 0
mov ecx, edi
je 0x487d9c
lea eax, [ebp - 0x374]
push eax
call fcn.00485070
push eax
lea ecx, [edi + 0xc4]
mov byte [ebp - 4], 0x10
call fcn.00427100
mov edx, dword [ebp - 0x374]
mov eax, ebx
mov byte [ebp - 4], 0xa
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x487da1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x487da1
call fcn.0048db40
mov eax, dword [edi + 0x10]
sub eax, 0x10
push eax
call fcn.00425f70
add eax, 0x10
mov dword [ebp - 0x350], eax
lea eax, [ebp - 0x350]
mov byte [ebp - 4], 0x11
push eax
call fcn.00474b30
add esp, 8
lea ecx, [ebp - 0x350]
push 0x13
push str.utilityinstall.ini
call fcn.00425dc0
push dword [ebp - 0x350]
xor eax, eax
push 0xa
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.false
push str.InstallPerUser
push 0x5c34ac
mov dword [ebp - 0x368], eax
call eax
lea eax, [ebp - 0x2c]
push str.true
push eax
call fcn.0054b581
add esp, 8
neg eax
sbb eax, eax
inc eax
mov dword [edi + 0xe0], eax
push dword [ebp - 0x350]
push str.false
push str.needAdmin
push 0x5c34ac
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [edi + 0x10]
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x36c], eax
call fcn.0046d6d0
test eax, eax
je 0x4887f9
mov dword [edi + 8], 0
cmp byte [0x62a1c4], 0
je 0x487ead
push 0
push 0
push 0x5bed51
push str.StepPreUninstallBegin
push 1
call fcn.004c7f40
add esp, 0x14
cmp byte [0x62a1c4], 0
je 0x487ead
push 0
push str.StepPreUninstallBegin
call fcn.004c7fa0
add esp, 8
push str.1180_tKUninstall::RealUninstallFunc_tuninstall_begin...
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov esi, dword [str._FPcd]
add esp, 0x10
cmp dword [edi + 0x50], 0
mov dword [ebp - 0x374], esi
je 0x487f63
push str.Performing_the_preparation_before_uninstallation
lea ecx, [ebp - 0x390]
call fcn.0043f4e0
lea eax, [ebp - 0x390]
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x398]
mov ecx, 0x629f1c
push eax
call fcn.004ad020
push dword [edi + 0x28]
mov byte [ebp - 4], 0x13
push dword [eax]
mov eax, dword [edi + 0x50]
push 0
push 1
push esi
call eax
mov edx, dword [ebp - 0x398]
add esp, 0x14
mov byte [ebp - 4], 0x12
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x487f42
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x390]
mov eax, ebx
mov byte [ebp - 4], 0x11
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x487f63
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [0x62a1c4], 0
je 0x487f9c
push 0
push 0
push 0x5bed51
push str.StepExecBeforeDeleteFile
push 1
call fcn.004c7f00
add esp, 0x14
cmp byte [0x62a1c4], 0
je 0x487f9c
push 0
push str.StepExecBeforeDeleteFile
call fcn.004c7f80
add esp, 8
mov ecx, edi
call fcn.004821d0
cmp byte [0x62a1c4], 0
mov esi, eax
je 0x487fde
push 0
push 0
push 0x5bed51
push str.StepExecBeforeDeleteFile
push 1
call fcn.004c7f40
add esp, 0x14
cmp byte [0x62a1c4], 0
je 0x487fde
push 0
push str.StepExecBeforeDeleteFile
call fcn.004c7fa0
add esp, 8
test esi, esi
jne 0x488078
cmp dword [edi + 0x50], esi
je 0x488078
push str.Failed_to_perform_the_preparation_before_uninstallation
lea ecx, [ebp - 0x38c]
call fcn.0043f4e0
lea eax, [ebp - 0x38c]
mov byte [ebp - 4], 0x14
push eax
lea eax, [ebp - 0x39c]
mov ecx, 0x629f1c
push eax
call fcn.004ad020
push dword [edi + 0x28]
mov byte [ebp - 4], 0x15
push dword [eax]
mov eax, dword [edi + 0x50]
push 2
push 1
push dword [ebp - 0x374]
call eax
mov edx, dword [ebp - 0x39c]
add esp, 0x14
mov byte [ebp - 4], 0x14
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x488057
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x38c]
mov eax, ebx
mov byte [ebp - 4], 0x11
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x488078
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [edi + 0x50], 0
mov esi, dword [0x61b7c0]
je 0x48810c
push str.Deleting_files
lea ecx, [ebp - 0x388]
call fcn.0043f4e0
lea eax, [ebp - 0x388]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x3a0]
mov ecx, 0x629f1c
push eax
call fcn.004ad020
push dword [edi + 0x28]
mov byte [ebp - 4], 0x17
push dword [eax]
mov eax, dword [edi + 0x50]
push 0
push 2
push esi
call eax
mov edx, dword [ebp - 0x3a0]
add esp, 0x14
mov byte [ebp - 4], 0x16
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4880eb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x388]
mov eax, ebx
mov byte [ebp - 4], 0x11
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48810c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea esi, [edi + 0x10]
push esi
lea ecx, [ebp - 0x34c]
call fcn.00427100
lea eax, [ebp - 0x34c]
push eax
call fcn.00474b30
add esp, 4
lea ecx, [ebp - 0x34c]
push 0x13
push str.office6KsoPost.exe
call fcn.00425dc0
lea eax, [ebp - 0x358]
mov ecx, edi
push eax
call fcn.0048dea0
push 0xb
push str.KsoPost.exe
lea ecx, [ebp - 0x358]
call fcn.00425dc0
push dword [ebp - 0x34c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x488180
push 0
push dword [ebp - 0x358]
push dword [ebp - 0x34c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
lea ecx, [ebp - 0x360]
call fcn.00427100
lea eax, [ebp - 0x360]
push eax
call fcn.00474b30
add esp, 4
lea ecx, [ebp - 0x360]
push 0x13
push str.utilityinstall.ini
call fcn.00425dc0
push dword [ebp - 0x360]
lea eax, [ebp - 0x18]
push 3
push eax
push 0x5b151c
push str.withKsoPost
push str.installinfo
call dword [ebp - 0x368]
push esi
lea ecx, [ebp - 0x35c]
call fcn.00427100
lea eax, [ebp - 0x35c]
push eax
call fcn.00474b30
add esp, 4
lea ecx, [ebp - 0x35c]
push 0x16
push str.office6cfgs_setup.cfg
call fcn.00425dc0
push dword [ebp - 0x35c]
lea eax, [ebp - 0x234]
push 0x104
push eax
push 0x5b0144
push str.Version
push 0x5c3628
call dword [ebp - 0x368]
push 0
call fcn.00471130
add esp, 4
cmp byte [0x62a1c4], 0
je 0x488265
push 0
push 0
push 0x5bed51
push str.StepDeleteFile
push 1
call fcn.004c7f00
add esp, 0x14
cmp byte [0x62a1c4], 0
je 0x488265
push 0
push str.StepDeleteFile
call fcn.004c7f80
add esp, 8
mov ecx, edi
call fcn.00480550
mov ecx, edi
call fcn.0047eb10
cmp dword [edi + 0x50], 0
mov esi, dword [0x61b7c4]
je 0x488307
push str.Deleting_files
lea ecx, [ebp - 0x384]
call fcn.0043f4e0
lea eax, [ebp - 0x384]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x3a4]
mov ecx, 0x629f1c
push eax
call fcn.004ad020
push dword [edi + 0x28]
mov byte [ebp - 4], 0x19
push dword [eax]
mov eax, dword [edi + 0x50]
push 0
push 3
push esi
call eax
mov edx, dword [ebp - 0x3a4]
add esp, 0x14
mov byte [ebp - 4], 0x18
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4882e6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x384]
mov eax, ebx
mov byte [ebp - 4], 0x11
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x488307
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, edi
call fcn.00481170
push str.1231_tKUninstall::RealUninstallFunc_tstart_delete_old_version_product
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
add esp, 0x10
cmp dword [edi + 0xdc], 0
je 0x488347
lea eax, [edi + 0xc4]
push eax
lea ecx, [ebp - 0x364]
call fcn.00427100
jmp 0x488386
lea eax, [ebp - 0x378]
mov ecx, edi
push eax
call fcn.00487300
push eax
lea ecx, [ebp - 0x364]
mov byte [ebp - 4], 0x1a
call fcn.00427100
mov edx, dword [ebp - 0x378]
mov eax, ebx
mov byte [ebp - 4], 0x11
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x488386
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov esi, esp
mov dword [ebp - 0x378], esi
mov eax, dword [ebp - 0x364]
add eax, 0xfffffff0
push eax
call fcn.00425f70
add esp, 4
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.0047e550
cmp byte [0x62a1c4], 0
je 0x4883e6
push 0
push 0
push 0x5bed51
push str.StepDeleteFile
push 1
call fcn.004c7f40
add esp, 0x14
cmp byte [0x62a1c4], 0
je 0x4883e6
push 0
push str.StepDeleteFile
call fcn.004c7fa0
add esp, 8
push dword [ebp - 0x364]
push str.1242_tKUninstall::RealUninstallFunc_tend_delete_old_version__ws__product
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
push 1
call fcn.00471130
add esp, 0x18
lea ecx, [edi + 0x2c]
call fcn.0047bb50
push str.office6werhandler.dll
lea eax, [edi + 0x10]
push eax
lea eax, [ebp - 0x3a8]
push eax
call fcn.00425c00
push dword [eax]
mov byte [ebp - 4], 0x1b
call fcn.004439f0
mov edx, dword [ebp - 0x3a8]
add esp, 0x10
mov byte [ebp - 4], 0x11
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48845b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [edi + 0x50], 0
mov esi, dword [0x61b7c8]
je 0x4884ef
push str.Unregistering
lea ecx, [ebp - 0x370]
call fcn.0043f4e0
lea eax, [ebp - 0x370]
mov byte [ebp - 4], 0x1c
push eax
lea eax, [ebp - 0x37c]
mov ecx, 0x629f1c
push eax
call fcn.004ad020
push dword [edi + 0x28]
mov byte [ebp - 4], 0x1d
push dword [eax]
mov eax, dword [edi + 0x50]
push 0
push 4
push esi
call eax
mov edx, dword [ebp - 0x37c]
add esp, 0x14
mov byte [ebp - 4], 0x1c
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4884ce
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x370]
mov eax, ebx
mov byte [ebp - 4], 0x11
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4884ef
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [edi + 4], 0
jne 0x48863f
mov ecx, 0x5b3ec4
lea eax, [ebp - 0x18]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x488527
test dx, dx
je 0x488523
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x488527
add eax, 4
add ecx, 4
test dx, dx
jne 0x488501
xor eax, eax
jmp 0x48852c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x48863f
call fcn.0043c120
test eax, eax
je 0x488555
push 1
push str.WithKsoPost
call fcn.00459bf0
add esp, 8
cmp eax, 1
jne 0x48863f
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x488b31
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x344], eax
mov eax, str._u__GUID___p__PipeName___n_kso__v__InstalledBuildVersion___i_0
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x344]
test eax, 0xffff0000
jne 0x488593
movzx eax, ax
push eax
call fcn.00426130
jmp 0x48859f
push 0x3e
push str._u__GUID___p__PipeName___n_kso__v__InstalledBuildVersion___i_0
call fcn.004263f0
push dword [ebp - 0x340]
lea ecx, [ebp - 0x344]
mov byte [ebp - 4], 0x1f
push str._GUID_
call fcn.0045b810
lea eax, [ebp - 0x234]
push eax
push str._InstalledBuildVersion_
lea ecx, [ebp - 0x344]
call fcn.0045b810
mov eax, dword [ebp - 0x348]
cmp dword [eax - 0xc], 0
jne 0x4885f4
push 0xe
push str.00001.00000002
lea ecx, [ebp - 0x348]
call fcn.004263f0
mov eax, dword [ebp - 0x348]
push eax
push str._PipeName_
lea ecx, [ebp - 0x344]
call fcn.0045b810
mov esi, dword [ebp - 0x344]
push 0
push 1
push 0
push 1
push 0
push esi
push dword [ebp - 0x358]
call fcn.00474e60
add esp, 0x1c
mov byte [ebp - 4], 0x11
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x48863f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [0x62a1c4], 0
je 0x488678
push 0
push 0
push 0x5bed51
push str.StepDeregister
push 1
call fcn.004c7f00
add esp, 0x14
cmp byte [0x62a1c4], 0
je 0x488678
push 0
push str.StepDeregister
call fcn.004c7f80
add esp, 8
xor esi, esi
mov dword [ebp - 0x37c], esi
push str.1007_tKUninstall::Deregister_tRunApp_Deregister_...
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
mov byte [ebp - 4], 0x20
call fcn.004638c0
add esp, 0x10
cmp byte [0x62a1c4], 0
je 0x4886d6
push esi
push esi
push 0x5bed51
push str.StepDeregisterUninstall
push 1
call fcn.004c7f00
add esp, 0x14
cmp byte [0x62a1c4], 0
je 0x4886d6
push esi
push str.StepDeregisterUninstall
call fcn.004c7f80
add esp, 8
mov ecx, edi
call fcn.00489890
cmp byte [0x62a1c4], 0
mov dword [ebp - 0x370], eax
je 0x48871c
push 0
push 0
push 0x5bed51
push str.StepDeregisterUninstall
push 1
call fcn.004c7f40
add esp, 0x14
cmp byte [0x62a1c4], 0
je 0x48871c
push 0
push str.StepDeregisterUninstall
call fcn.004c7fa0
add esp, 8
push dword [ebp - 0x370]
push str.1012_tKUninstall::Deregister_tRunApp_Deregister_return:_d
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
cmp dword [ebp - 0x370], 0
mov eax, 1
cmovne esi, eax
push esi
push str.1019_tKUninstall::Deregister_tKInsall::Deregister_return:_d
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
add esp, 0x28
mov byte [ebp - 4], 0x11
cmp byte [0x62a1c4], 0
je 0x4887dd
push 0
push 0
push 0x5bed51
push str.StepDeregister
push 1
call fcn.004c7f40
add esp, 0x14
cmp byte [0x62a1c4], 0
je 0x4887dd
push 0
push str.StepDeregister
call fcn.004c7fa0
add esp, 8
cmp byte [0x62a1c4], 0
je 0x4887dd
push 0
push 0
push 0x5bed51
push str.StepEndUninstall
push 1
call fcn.004c7f00
add esp, 0x14
cmp byte [0x62a1c4], 0
je 0x4887dd
push 0
push str.StepEndUninstall
call fcn.004c7f80
add esp, 8
mov ecx, edi
call fcn.0047dcd0
mov ecx, edi
call fcn.0047d7e0
mov ecx, edi
call fcn.0047d5f0
mov dword [edi + 8], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x36c]
cmp dword [edi + 0x50], 0
mov dword [edi + 0x4c], eax
mov esi, dword [0x61b7cc]
je 0x4888e5
cmp dword [edi + 8], 0
je 0x4888e5
push str.Uninstallation_completed
lea ecx, [ebp - 0x380]
call fcn.0043f4e0
lea eax, [ebp - 0x380]
mov byte [ebp - 4], 0x21
push eax
lea eax, [ebp - 0x3ac]
mov ecx, 0x629f1c
push eax
call fcn.004ad020
push dword [edi + 0x28]
mov byte [ebp - 4], 0x22
push dword [eax]
mov eax, dword [edi + 0x50]
push 0
push 5
push esi
call eax
mov edx, dword [ebp - 0x3ac]
add esp, 0x14
mov byte [ebp - 4], 0x21
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x488885
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x380]
mov eax, ebx
mov byte [ebp - 4], 0x11
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4888a6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi + 0xd0]
cmp dword [eax - 0xc], 0
je 0x4888e5
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push 0
push 0
push eax
push str.open
push 0
call esi
cmp eax, 0x20
jg 0x4888e5
push 1
push 0
push dword [edi + 0xd0]
push str.iexplore
push str.open
push 0
call esi
cmp dword [edi + 0x48], 0
je 0x48892e
push str.1299_tKUninstall::RealUninstallFunc_twait_wpsmain
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
add esp, 0x10
push 0xffffffffffffffff
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.1301_tKUninstall::RealUninstallFunc_twait_wpsmain_end
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
add esp, 0x10
push dword [edi + 0x4c]
push dword [edi + 8]
push str.1304_tKUninstall::RealUninstallFunc_tuninstall_end__return:_d__install_cost_time:_dms
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
add esp, 0x18
cmp byte [0x62a1c4], 0
je 0x488989
push 0
push 0
push 0x5bed51
push str.StepEndUninstall
push 1
call fcn.004c7f40
add esp, 0x14
cmp byte [0x62a1c4], 0
je 0x488989
push 0
push str.StepEndUninstall
call fcn.004c7fa0
add esp, 8
mov edx, dword [ebp - 0x350]
mov eax, ebx
mov byte [ebp - 4], 0xa
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4889aa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x340]
mov eax, ebx
mov byte [ebp - 4], 8
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4889cb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x33c]
call fcn.0047cc40
mov eax, dword [ebp - 0x354]
test eax, eax
je 0x4889e7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x348]
mov eax, ebx
mov dword [ebp - 0x354], 0
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x488a12
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x358]
mov eax, ebx
mov byte [ebp - 4], 4
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x488a33
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x35c]
mov eax, ebx
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x488a54
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x360]
mov eax, ebx
mov byte [ebp - 4], 2
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x488a75
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x34c]
mov eax, ebx
mov byte [ebp - 4], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x488a96
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x364]
mov eax, ebx
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x488ab7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x394]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x488ad9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053d079
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00425f50
push 0x80004005
call fcn.00425f50
push 0x80004005
call fcn.00425f50
push 0x80004005
call fcn.00425f50
push 0x80070057
call fcn.00425f50
call fcn.0054b0c3
call fcn.0054b0c3
push 0x80004005
call fcn.00425f50
int3