Function at 0x4b25e0
Capabilities:
Delete file
Get common file path
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f5d5
mov eax, dword fs:[0]
push eax
sub esp, 0x6e4
mov eax, dword [0x62819c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push 0x208
push eax
mov dword [ebp - 0x694], eax
mov dword [ebp - 0x660], eax
lea eax, [ebp - 0x420]
push eax
call fcn.0054b380
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b4576
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x670], eax
lea edi, [ebp - 0x420]
mov dword [ebp - 4], 0
shr edi, 0x10
test edi, edi
jne 0x4b268c
lea eax, [ebp - 0x420]
movzx ebx, ax
lea ecx, [ebp - 0x670]
push ebx
call fcn.004295b0
jmp 0x4b26c0
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b2695
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x670]
call fcn.00429870
lea eax, [ebp - 0x420]
movzx ebx, ax
lea eax, [ebp - 0x670]
mov dword [ebp - 4], 1
push eax
call fcn.00479790
add esp, 4
lea ecx, [ebp - 0x670]
push 0xd
push str.kingsoftqing
call fcn.00429240
push 0
push 1
push 1
push dword [ebp - 0x670]
call fcn.00474ee0
add esp, 0x10
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b4580
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x664], eax
mov byte [ebp - 4], 2
test edi, edi
jne 0x4b272f
push ebx
lea ecx, [ebp - 0x664]
call fcn.004295b0
jmp 0x4b2762
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
jmp 0x4b2740
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b2740
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x664]
call fcn.00429870
lea eax, [ebp - 0x664]
mov byte [ebp - 4], 3
push eax
call fcn.00479790
add esp, 4
lea ecx, [ebp - 0x664]
push 0x12
push str.kingsoftWPS_Cloud
call fcn.00429240
push 0
push 1
push 1
push dword [ebp - 0x664]
call fcn.00474ee0
mov edx, dword [ebp - 0x664]
or esi, 0xffffffff
add esp, 0x10
mov byte [ebp - 4], 1
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b27bf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x670]
mov eax, esi
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b27e3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x20a
lea eax, [ebp - 0x62c]
push 0
push eax
call fcn.0054b380
add esp, 0xc
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b458a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x698], eax
push 0x104
lea eax, [ebp - 0x62c]
mov dword [ebp - 4], 4
push eax
push 0x1a
call fcn.00477420
lea ecx, [ebp - 0x62c]
add esp, 0xc
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b2840
sub ecx, edx
lea eax, [ebp - 0x62c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x698]
call fcn.00429870
lea eax, [ebp - 0x698]
push eax
call fcn.00479790
mov eax, dword [ebp - 0x698]
add eax, 0xfffffff0
push eax
call fcn.004293f0
add eax, 0x10
add esp, 8
mov dword [ebp - 0x6a4], eax
push 0x25
push str.Kingsoftoffice6OfficeSpace_resource
lea ecx, [ebp - 0x6a4]
mov byte [ebp - 4], 5
call fcn.00429240
mov esi, dword [ebp - 0x6a4]
push 0
push 1
push 1
push esi
call fcn.00474ee0
add esp, 0x10
mov byte [ebp - 4], 4
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4b28d0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x698]
add eax, 0xfffffff0
push eax
call fcn.004293f0
add eax, 0x10
add esp, 4
mov dword [ebp - 0x664], eax
push 0x10
push str.qingdatadefault
lea ecx, [ebp - 0x664]
mov byte [ebp - 4], 6
call fcn.00429240
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b4594
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x678], eax
mov byte [ebp - 4], 7
test edi, edi
jne 0x4b2934
push ebx
lea ecx, [ebp - 0x678]
call fcn.004295b0
jmp 0x4b2962
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b2940
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x678]
call fcn.00429870
lea eax, [ebp - 0x678]
mov byte [ebp - 4], 8
push eax
call fcn.00479790
add esp, 4
lea ecx, [ebp - 0x678]
push 0x1a
push str.kingsoftWPS_Cloudupdate_
call fcn.00429240
push ecx
mov esi, esp
mov dword [ebp - 0x684], esp
mov dword [ebp - 0x66c], esi
mov eax, dword [ebp - 0x678]
add eax, 0xfffffff0
push eax
call fcn.004293f0
add eax, 0x10
mov dword [esi], eax
mov esi, esp
mov byte [ebp - 4], 9
mov dword [ebp - 0x66c], esi
mov eax, dword [ebp - 0x664]
add eax, 0xfffffff0
push eax
call fcn.004293f0
add esp, 4
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 8
call fcn.004a8b10
add esp, 8
lea eax, [ebp - 0x698]
lea ecx, [ebp - 0x664]
push eax
call fcn.0042a6a0
push 0x15
push str.kingsoftqingdefault
lea ecx, [ebp - 0x664]
call fcn.00429240
push ecx
mov esi, esp
mov dword [ebp - 0x684], esp
mov dword [ebp - 0x66c], esi
mov eax, dword [ebp - 0x678]
add eax, 0xfffffff0
push eax
call fcn.004293f0
add eax, 0x10
mov dword [esi], eax
mov esi, esp
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x66c], esi
mov edi, dword [ebp - 0x664]
add edi, 0xfffffff0
push edi
call fcn.004293f0
add esp, 4
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 8
call fcn.004a8b10
push str.upqing.exe
lea eax, [ebp - 0x678]
push eax
lea eax, [ebp - 0x680]
push eax
call fcn.00429080
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x14
push dword [eax]
call esi
mov edx, dword [ebp - 0x680]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b2a91
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.version.ini
lea eax, [ebp - 0x678]
push eax
lea eax, [ebp - 0x680]
push eax
call fcn.00429080
add esp, 0xc
push dword [eax]
call esi
mov edx, dword [ebp - 0x680]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b2acd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x698]
add eax, 0xfffffff0
push eax
call fcn.004293f0
add eax, 0x10
add esp, 4
mov dword [ebp - 0x670], eax
push 0xd
push str.kingsoftqing
lea ecx, [ebp - 0x670]
mov byte [ebp - 4], 0xb
call fcn.00429240
push 0
push 1
push 1
push dword [ebp - 0x670]
call fcn.00474ee0
add esp, 0x10
lea eax, [ebp - 0x698]
lea ecx, [ebp - 0x670]
push eax
call fcn.0042a6a0
push 8
push str.qingdata
lea ecx, [ebp - 0x670]
call fcn.00429240
mov esi, dword [ebp - 0x670]
push 0
push 1
push 1
push esi
call fcn.00474ee0
add esp, 0x10
mov byte [ebp - 4], 8
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4b2b66
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x678]
or esi, 0xffffffff
mov byte [ebp - 4], 6
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b2b8a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4b2ba2
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b459e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x690], eax
mov eax, str.DisableDelAccountData
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x690]
test eax, 0xffff0000
jne 0x4b2be0
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4b2bec
push 0x15
push str.DisableDelAccountData
call fcn.00429870
lea eax, [ebp - 0x690]
mov byte [ebp - 4], 0xd
push eax
call fcn.004ab740
mov edx, dword [ebp - 0x690]
add esp, 4
test eax, eax
mov byte [ebp - 4], 4
mov eax, esi
sete bl
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b2c25
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x4b2c85
lea eax, [ebp - 0x668]
mov ecx, 0x6319b8
push eax
call fcn.0048b470
push 0x15
push str.Kingsoftkaccountsdk
lea ecx, [ebp - 0x668]
mov byte [ebp - 4], 0xe
call fcn.00429240
push 0
push 1
push 0
push dword [ebp - 0x668]
call fcn.00474ee0
mov edx, dword [ebp - 0x668]
add esp, 0x10
mov byte [ebp - 4], 4
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b2c85
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x6a8]
mov ecx, 0x6319b8
push eax
call fcn.0048b750
push 0x27
push str.KingsoftWPS_Cloud_Filesuserdataqing
lea ecx, [ebp - 0x6a8]
mov byte [ebp - 4], 0xf
call fcn.00429240
push str.config.ini
lea eax, [ebp - 0x6a8]
push eax
lea eax, [ebp - 0x6c0]
push eax
call fcn.00429080
add esp, 0xc
cmp dword [ebp + 8], 0
mov byte [ebp - 4], 0x10
jne 0x4b44b5
lea eax, [ebp - 0x6a4]
mov ecx, 0x6319b8
push eax
call fcn.0048b750
push 0x22
push str.KingsoftWPS_Cloud_Filesuserdata
lea ecx, [ebp - 0x6a4]
mov byte [ebp - 4], 0x11
call fcn.00429240
lea eax, [ebp - 0x65c]
push 1
push eax
call fcn.00513110
add esp, 8
cmp dword [ebp - 0x64c], 0
mov byte [ebp - 4], 0x12
je 0x4b2d4c
cmp dword [ebp - 0x648], 8
lea eax, [ebp - 0x65c]
push str.zh_CN
cmovae eax, dword [ebp - 0x65c]
push eax
call fcn.00555852
add esp, 8
test eax, eax
je 0x4b2d4c
mov eax, 0x5c094c
mov ecx, 8
jmp 0x4b2d56
mov eax, str.qing
mov ecx, 5
push ecx
push eax
lea ecx, [ebp - 0x6a4]
call fcn.00429240
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b45a8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x690], eax
mov eax, str.SOFTWAREKingsoftWPSCloud
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x690]
test eax, 0xffff0000
jne 0x4b2da1
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4b2dad
push 0x1a
push str.SOFTWAREKingsoftWPSCloud
call fcn.00429870
mov byte [ebp - 4], 0x14
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b45b2
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x68c], esi
mov edi, dword [ebp - 0x690]
lea eax, [ebp - 0x664]
push eax
push edi
push 0x80000001
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x664], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [ebp - 0x664]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x688], 0
test eax, eax
je 0x4b2eed
lea ecx, [ebp - 0x688]
push ecx
push 0
lea ecx, [ebp - 0x674]
push ecx
push 0
push str.NeedUninstallQingUserData
push eax
call ebx
mov eax, dword [ebp - 0x674]
cmp eax, 1
je 0x4b2e41
cmp eax, 2
jne 0x4b2edc
lea ecx, [ebp - 0x68c]
call fcn.00429490
mov edx, dword [ebp - 0x688]
shr edx, 1
add edx, 1
js 0x4b45bc
mov esi, dword [ebp - 0x68c]
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x4b2e86
push edx
lea ecx, [ebp - 0x68c]
call fcn.004296d0
mov esi, dword [ebp - 0x68c]
lea eax, [ebp - 0x688]
push eax
push esi
lea eax, [ebp - 0x674]
push eax
push 0
push str.NeedUninstallQingUserData
push dword [ebp - 0x664]
call ebx
test eax, eax
jne 0x4b2edc
mov eax, dword [ebp - 0x688]
xor ecx, ecx
shr eax, 1
mov word [esi + eax*2], cx
push dword [esi - 8]
push esi
call fcn.00555593
add esp, 8
test eax, eax
js 0x4b45bc
cmp eax, dword [esi - 8]
jg 0x4b45bc
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov eax, dword [ebp - 0x664]
test eax, eax
je 0x4b2eed
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x664], 0
mov ecx, 0x5b3dbc
mov eax, esi
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4b2f26
test dx, dx
je 0x4b2f22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4b2f26
add eax, 4
add ecx, 4
test dx, dx
jne 0x4b2f00
xor ebx, ebx
jmp 0x4b2f2b
sbb ebx, ebx
or ebx, 1
mov dword [ebp - 0x664], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 0x14
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4b2f51
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
je 0x4b4349
mov dword [ebp - 0x6bc], 0
mov dword [ebp - 0x6b8], 0
mov dword [ebp - 0x6b4], 0
add edi, 0xfffffff0
mov byte [ebp - 4], 0x17
push edi
call fcn.004293f0
add eax, 0x10
add esp, 4
mov dword [ebp - 0x68c], eax
push 1
push 0x5ad728
lea ecx, [ebp - 0x68c]
mov byte [ebp - 4], 0x18
call fcn.00429240
push 0xa
push str.usercenter
lea ecx, [ebp - 0x68c]
call fcn.00429240
mov esi, dword [ebp - 0x68c]
lea eax, [ebp - 0x674]
push eax
push 0x2001f
push 0
push esi
push 0x80000001
mov dword [ebp - 0x674], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b3ffa
mov edi, dword [ebp - 0x674]
push eax
push eax
push eax
push eax
mov dword [ebp - 0x6b8], eax
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x6d8], eax
lea eax, [ebp - 0x6d8]
push eax
push 0
push 0
lea eax, [ebp - 0x674]
mov dword [ebp - 0x6bc], edi
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor ebx, ebx
mov dword [ebp - 0x6a0], ebx
cmp dword [ebp - 0x674], ebx
jbe 0x4b3fdb
nop
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0054b380
add esp, 0xc
mov dword [ebp - 0x6dc], 0x104
lea eax, [ebp - 0x6f0]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x6dc]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4b3fc8
add esi, 0xfffffff0
push esi
call fcn.004293f0
add eax, 0x10
add esp, 4
mov dword [ebp - 0x688], eax
push 1
push 0x5ad728
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0x19
call fcn.00429240
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b30c0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x688]
call fcn.00429240
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b4576
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x660], esi
lea eax, [ebp - 0x678]
mov byte [ebp - 4], 0x1b
push eax
push dword [ebp - 0x688]
mov dword [ebp - 0x678], 0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0x668], 0
test eax, eax
je 0x4b321e
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x668]
push ecx
push 0
lea ecx, [ebp - 0x6d4]
push ecx
push 0
push str.cacheFileRoot
push eax
call ebx
mov eax, dword [ebp - 0x6d4]
cmp eax, 1
je 0x4b3171
cmp eax, 2
jne 0x4b320c
lea ecx, [ebp - 0x660]
call fcn.00429490
mov edx, dword [ebp - 0x668]
shr edx, 1
add edx, 1
js 0x4b45bc
mov esi, dword [ebp - 0x660]
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x4b31b6
push edx
lea ecx, [ebp - 0x660]
call fcn.004296d0
mov esi, dword [ebp - 0x660]
lea eax, [ebp - 0x668]
push eax
push esi
lea eax, [ebp - 0x6d4]
push eax
push 0
push str.cacheFileRoot
push dword [ebp - 0x678]
call ebx
test eax, eax
jne 0x4b320c
mov eax, dword [ebp - 0x668]
xor ecx, ecx
shr eax, 1
mov word [esi + eax*2], cx
push dword [esi - 8]
push esi
call fcn.00555593
add esp, 8
test eax, eax
js 0x4b45bc
cmp eax, dword [esi - 8]
jg 0x4b45bc
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov eax, dword [ebp - 0x678]
test eax, eax
je 0x4b321e
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
mov dword [ebp - 0x678], 0
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b4576
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x668], eax
mov eax, 0x5ad72c
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x668]
test eax, 0xffff0000
jne 0x4b3266
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4b3272
push 1
push 0x5ad72c
call fcn.00429870
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 0x1d
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b3280
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x668]
call fcn.00429240
cmp dword [esi - 0xc], 0
mov edi, dword [ebp - 0x668]
je 0x4b3307
push ecx
lea eax, [edi - 0x10]
mov dword [ebp - 0x66c], esp
mov ebx, esp
push eax
mov dword [ebp - 0x67c], ebx
call fcn.004293f0
add eax, 0x10
mov dword [ebx], eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0x1e
mov ebx, esp
push eax
mov dword [ebp - 0x67c], ebx
call fcn.004293f0
add esp, 4
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0x1d
call fcn.004aad20
add esp, 8
test eax, eax
je 0x4b3307
push 0
push 1
push 1
push esi
call fcn.00474ee0
add esp, 0x10
or ebx, 0xffffffff
mov byte [ebp - 4], 0x1b
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4b3325
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x678]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4b3338
push eax
call edi
mov dword [ebp - 0x678], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 0x19
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4b335d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b4576
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x668], esi
lea eax, [ebp - 0x69c]
mov byte [ebp - 4], 0x20
push eax
push dword [ebp - 0x688]
mov dword [ebp - 0x69c], 0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [ebp - 0x69c]
mov dword [ebp - 0x660], 0
test eax, eax
je 0x4b3496
lea ecx, [ebp - 0x660]
push ecx
push 0
lea ecx, [ebp - 0x6d0]
push ecx
push 0
push str.syncFileRoot
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x6d0]
cmp eax, 1
je 0x4b33ea
cmp eax, 2
jne 0x4b3489
lea ecx, [ebp - 0x668]
call fcn.00429490
mov edx, dword [ebp - 0x660]
shr edx, 1
add edx, 1
js 0x4b45bc
mov esi, dword [ebp - 0x668]
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x4b342f
push edx
lea ecx, [ebp - 0x668]
call fcn.004296d0
mov esi, dword [ebp - 0x668]
lea eax, [ebp - 0x660]
push eax
push esi
lea eax, [ebp - 0x6d0]
push eax
push 0
push str.syncFileRoot
push dword [ebp - 0x69c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b3489
mov eax, dword [ebp - 0x660]
xor ecx, ecx
shr eax, 1
mov word [esi + eax*2], cx
push dword [esi - 8]
push esi
call fcn.00555593
add esp, 8
test eax, eax
js 0x4b45bc
cmp eax, dword [esi - 8]
jg 0x4b45bc
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov eax, dword [ebp - 0x69c]
test eax, eax
je 0x4b3496
push eax
call edi
mov dword [ebp - 0x69c], 0
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b4576
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x660], eax
mov eax, 0x5c0a1c
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x660]
test eax, 0xffff0000
jne 0x4b34de
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4b34ea
push 4
push 0x5c0a1c
call fcn.00429870
cmp dword [esi - 0xc], 0
mov edi, dword [ebp - 0x660]
mov byte [ebp - 4], 0x22
je 0x4b367d
push ecx
lea eax, [edi - 0x10]
mov dword [ebp - 0x67c], esp
mov ebx, esp
push eax
mov dword [ebp - 0x66c], ebx
call fcn.004293f0
add eax, 0x10
mov dword [ebx], eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0x23
mov ebx, esp
push eax
mov dword [ebp - 0x66c], ebx
call fcn.004293f0
add esp, 4
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0x22
call fcn.004aad20
add esp, 8
test eax, eax
jne 0x4b366b
push ecx
mov ebx, esp
mov dword [ebp - 0x67c], esp
mov dword [ebp - 0x6e4], ebx
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b4576
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0x24
test eax, 0xffff0000
jne 0x4b3592
movzx eax, ax
mov ecx, ebx
push eax
call fcn.004295b0
jmp 0x4b35be
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
jmp 0x4b35a0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b35a0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.00429870
push ecx
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0x25
mov ebx, esp
push eax
mov dword [ebp - 0x66c], ebx
call fcn.004293f0
add esp, 4
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0x22
call fcn.004aad20
add esp, 8
test eax, eax
jne 0x4b366b
push ecx
mov ebx, esp
mov dword [ebp - 0x67c], esp
mov dword [ebp - 0x6e8], ebx
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b4576
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov eax, str.WPS_Cloud_Files
mov byte [ebp - 4], 0x26
mov ecx, ebx
test eax, 0xffff0000
jne 0x4b3631
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4b363d
push 0xf
push str.WPS_Cloud_Files
call fcn.00429870
push ecx
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0x27
mov ebx, esp
push eax
mov dword [ebp - 0x66c], ebx
call fcn.004293f0
add esp, 4
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0x22
call fcn.004aad20
add esp, 8
test eax, eax
je 0x4b367a
push 0
push 1
push 1
push esi
call fcn.00474ee0
add esp, 0x10
or ebx, 0xffffffff
mov byte [ebp - 4], 0x20
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4b3698
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x69c]
test eax, eax
je 0x4b36aa
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
mov dword [ebp - 0x69c], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 0x19
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4b36cf
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b4576
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x668], esi
mov edi, dword [ebp - 0x688]
lea eax, [ebp - 0x670]
push eax
push edi
push 0x80000001
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x670], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x660], 0
test eax, eax
je 0x4b380b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x660]
push ecx
push 0
lea ecx, [ebp - 0x6cc]
push ecx
push 0
push str.wpsDrivePersonalRoot
push eax
call ebx
mov eax, dword [ebp - 0x6cc]
cmp eax, 1
je 0x4b375f
cmp eax, 2
jne 0x4b37fa
lea ecx, [ebp - 0x668]
call fcn.00429490
mov edx, dword [ebp - 0x660]
shr edx, 1
add edx, 1
js 0x4b45bc
mov esi, dword [ebp - 0x668]
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x4b37a4
push edx
lea ecx, [ebp - 0x668]
call fcn.004296d0
mov esi, dword [ebp - 0x668]
lea eax, [ebp - 0x660]
push eax
push esi
lea eax, [ebp - 0x6cc]
push eax
push 0
push str.wpsDrivePersonalRoot
push dword [ebp - 0x670]
call ebx
test eax, eax
jne 0x4b37fa
mov eax, dword [ebp - 0x660]
xor ecx, ecx
shr eax, 1
mov word [esi + eax*2], cx
push dword [esi - 8]
push esi
call fcn.00555593
add esp, 8
test eax, eax
js 0x4b45bc
cmp eax, dword [esi - 8]
jg 0x4b45bc
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov eax, dword [ebp - 0x670]
test eax, eax
je 0x4b380b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x670], 0
cmp dword [esi - 0xc], 0
je 0x4b38a2
push ecx
mov ebx, esp
mov dword [ebp - 0x67c], esp
mov dword [ebp - 0x6c8], ebx
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b4576
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov eax, 0x5c0a74
mov byte [ebp - 4], 0x2a
mov ecx, ebx
test eax, 0xffff0000
jne 0x4b3864
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4b3870
push 5
push 0x5c0a74
call fcn.00429870
push ecx
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0x2b
mov ebx, esp
push eax
mov dword [ebp - 0x66c], ebx
call fcn.004293f0
add esp, 4
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0x29
call fcn.004aad20
add esp, 8
test eax, eax
jne 0x4b3985
lea eax, [ebp - 0x644]
push eax
call fcn.00512550
add esp, 4
mov ebx, eax
mov eax, dword [ebp - 0x694]
or eax, 1
mov byte [ebp - 4], 0x2c
cmp dword [ebx + 0x14], 8
mov dword [ebp - 0x694], eax
mov dword [ebp - 0x660], eax
jb 0x4b38d4
mov ebx, dword [ebx]
push ecx
mov dword [ebp - 0x67c], esp
mov dword [ebp - 0x6e0], esp
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b4576
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edx, dword [ebp - 0x6e0]
add eax, 0x10
mov dword [edx], eax
mov dword [ebp - 4], 0x2d
test ebx, ebx
je 0x4b3945
test ebx, 0xffff0000
jne 0x4b3920
movzx eax, bx
mov ecx, edx
push eax
call fcn.004295b0
jmp 0x4b3950
mov ecx, ebx
lea eax, [ecx + 2]
mov dword [ebp - 0x66c], eax
jmp 0x4b3930
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b3930
sub ecx, dword [ebp - 0x66c]
sar ecx, 1
jmp 0x4b3947
xor ecx, ecx
push ecx
push ebx
mov ecx, edx
call fcn.00429870
push ecx
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0x2e
mov ebx, esp
push eax
mov dword [ebp - 0x66c], ebx
call fcn.004293f0
add esp, 4
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0x2c
call fcn.004aad20
add esp, 8
test eax, eax
jne 0x4b3985
xor bl, bl
jmp 0x4b3987
mov bl, 1
mov eax, dword [ebp - 0x694]
mov dword [ebp - 4], 0x29
test al, 1
je 0x4b39e1
mov edx, dword [ebp - 0x630]
and eax, 0xfffffffe
mov dword [ebp - 0x694], eax
cmp edx, 8
jb 0x4b39e1
mov ecx, dword [ebp - 0x644]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4b39d7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b45d0
push edx
push ecx
call fcn.00546044
add esp, 8
test bl, bl
je 0x4b3afe
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b4576
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x660], eax
mov eax, str.clear_WpsDrivePersonalRoot__userid
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x660]
test eax, 0xffff0000
jne 0x4b3a27
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4b3a33
push 0x23
push str.clear_WpsDrivePersonalRoot__userid
call fcn.00429870
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 0x30
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b3a40
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x660]
call fcn.00429240
push ecx
mov ebx, esp
mov dword [ebp - 0x67c], ebx
mov eax, dword [ebp - 0x660]
add eax, 0xfffffff0
push eax
mov dword [ebp - 0x66c], eax
call fcn.004293f0
add esp, 4
lea ecx, [ebp - 0x644]
add eax, 0x10
mov dword [ebx], eax
call fcn.00468050
lea eax, [ebp - 0x6c4]
mov byte [ebp - 4], 0x31
push eax
push 1
push 1
push esi
mov dword [ebp - 0x6c4], 0
call fcn.00474ee0
push dword [ebp - 0x6c4]
push str.764_tkuserinfo::uninstallQing_tDeleteFolder_count:_d
push str.H:_rc_v11_i18n_20230711_branchCoding_support_newsetup_srccommonappKUninstallkuserinfo.cpp
push str._INFO_
push 0x631888
call fcn.004677c0
add esp, 0x24
lea ecx, [ebp - 0x644]
call fcn.00468130
mov edx, dword [ebp - 0x66c]
or eax, 0xffffffff
mov byte [ebp - 4], 0x29
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b3afe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x670]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4b3b11
push eax
call ebx
mov dword [ebp - 0x670], 0
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0x19
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b3b37
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b4576
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x668], esi
lea eax, [ebp - 0x664]
mov byte [ebp - 4], 0x33
push eax
push edi
push 0x80000001
mov dword [ebp - 0x664], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x660], 0
test eax, eax
je 0x4b3c6b
lea ecx, [ebp - 0x660]
push ecx
push 0
lea ecx, [ebp - 0x6ac]
push ecx
push 0
push str.wpsDriveEnterpriseRoot
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x6ac]
cmp eax, 1
je 0x4b3bbf
cmp eax, 2
jne 0x4b3c5e
lea ecx, [ebp - 0x668]
call fcn.00429490
mov edx, dword [ebp - 0x660]
shr edx, 1
add edx, 1
js 0x4b45bc
mov esi, dword [ebp - 0x668]
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x4b3c04
push edx
lea ecx, [ebp - 0x668]
call fcn.004296d0
mov esi, dword [ebp - 0x668]
lea eax, [ebp - 0x660]
push eax
push esi
lea eax, [ebp - 0x6ac]
push eax
push 0
push str.wpsDriveEnterpriseRoot
push dword [ebp - 0x664]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b3c5e
mov eax, dword [ebp - 0x660]
xor ecx, ecx
shr eax, 1
mov word [esi + eax*2], cx
push dword [esi - 8]
push esi
call fcn.00555593
add esp, 8
test eax, eax
js 0x4b45bc
cmp eax, dword [esi - 8]
jg 0x4b45bc
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov eax, dword [ebp - 0x664]
test eax, eax
je 0x4b3c6b
push eax
call ebx
mov dword [ebp - 0x664], 0
cmp dword [esi - 0xc], 0
je 0x4b3de5
push ecx
mov ebx, esp
mov dword [ebp - 0x67c], esp
mov dword [ebp - 0x6b0], ebx
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b4576
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov eax, 0x5c0b90
mov byte [ebp - 4], 0x34
mov ecx, ebx
test eax, 0xffff0000
jne 0x4b3cc4
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4b3cd0
push 7
push 0x5c0b90
call fcn.00429870
push ecx
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0x35
mov ebx, esp
push eax
mov dword [ebp - 0x66c], ebx
call fcn.004293f0
add esp, 4
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0x33
call fcn.004aad20
add esp, 8
test eax, eax
jne 0x4b3de1
lea eax, [ebp - 0x644]
push eax
call fcn.005126f0
add esp, 4
mov ebx, eax
mov eax, dword [ebp - 0x694]
or eax, 2
mov byte [ebp - 4], 0x36
cmp dword [ebx + 0x14], 8
mov dword [ebp - 0x694], eax
mov dword [ebp - 0x660], eax
jb 0x4b3d34
mov ebx, dword [ebx]
push ecx
mov dword [ebp - 0x67c], esp
mov dword [ebp - 0x684], esp
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b4576
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edx, dword [ebp - 0x684]
add eax, 0x10
mov dword [edx], eax
mov dword [ebp - 4], 0x37
test ebx, ebx
je 0x4b3da5
test ebx, 0xffff0000
jne 0x4b3d80
movzx eax, bx
mov ecx, edx
push eax
call fcn.004295b0
jmp 0x4b3db0
mov ecx, ebx
lea eax, [ecx + 2]
mov dword [ebp - 0x66c], eax
jmp 0x4b3d90
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b3d90
sub ecx, dword [ebp - 0x66c]
sar ecx, 1
jmp 0x4b3da7
xor ecx, ecx
push ecx
push ebx
mov ecx, edx
call fcn.00429870
push ecx
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0x38
mov ebx, esp
push eax
mov dword [ebp - 0x66c], ebx
call fcn.004293f0
add esp, 4
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0x36
call fcn.004aad20
add esp, 8
test eax, eax
je 0x4b3de5
mov bl, 1
jmp 0x4b3de7
xor bl, bl
mov eax, dword [ebp - 0x694]
mov dword [ebp - 4], 0x33
test al, 2
je 0x4b3e41
mov edx, dword [ebp - 0x630]
and eax, 0xfffffffd
mov dword [ebp - 0x694], eax
cmp edx, 8
jb 0x4b3e41
mov ecx, dword [ebp - 0x644]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4b3e37
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b45d0
push edx
push ecx
call fcn.00546044
add esp, 8
test bl, bl
je 0x4b3f62
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b4576
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x660], eax
mov eax, str.clear_WpsDriveEnterpriseRoot__userid
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x660]
test eax, 0xffff0000
jne 0x4b3e87
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4b3e93
push 0x25
push str.clear_WpsDriveEnterpriseRoot__userid
call fcn.00429870
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 0x3a
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b3ea0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x660]
call fcn.00429240
push ecx
mov ebx, esp
mov dword [ebp - 0x67c], ebx
mov eax, dword [ebp - 0x660]
add eax, 0xfffffff0
push eax
mov dword [ebp - 0x66c], eax
call fcn.004293f0
add esp, 4
lea ecx, [ebp - 0x644]
add eax, 0x10
mov dword [ebx], eax
call fcn.00468050
lea eax, [ebp - 0x680]
mov byte [ebp - 4], 0x3b
push eax
push 1
push 1
push esi
mov dword [ebp - 0x680], 0
call fcn.00474ee0
push dword [ebp - 0x680]
push str.788_tkuserinfo::uninstallQing_tDeleteFolder_count:_d
push str.H:_rc_v11_i18n_20230711_branchCoding_support_newsetup_srccommonappKUninstallkuserinfo.cpp
push str._INFO_
push 0x631888
call fcn.004677c0
add esp, 0x24
lea ecx, [ebp - 0x644]
call fcn.00468130
mov edx, dword [ebp - 0x66c]
or ebx, 0xffffffff
mov byte [ebp - 4], 0x33
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b3f65
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4b3f65
or ebx, 0xffffffff
mov eax, dword [ebp - 0x664]
test eax, eax
je 0x4b3f76
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x664], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 0x19
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4b3f9b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x18
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4b3fb6
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x6bc]
mov ebx, dword [ebp - 0x6a0]
mov esi, dword [ebp - 0x68c]
inc ebx
mov dword [ebp - 0x6a0], ebx
cmp ebx, dword [ebp - 0x674]
jb 0x4b3040
test edi, edi
je 0x4b3ff0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6bc], 0
mov dword [ebp - 0x6b8], 0
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b45c6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x674], eax
mov eax, str.clear_WpsDrivePath
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x674]
test eax, 0xffff0000
jne 0x4b4038
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4b4044
push 0x12
push str.clear_WpsDrivePath
call fcn.00429870
push ecx
mov edi, esp
mov byte [ebp - 4], 0x3d
mov dword [ebp - 0x6b0], edi
mov eax, dword [ebp - 0x674]
add eax, 0xfffffff0
push eax
mov dword [ebp - 0x684], eax
call fcn.004293f0
add esp, 4
lea ecx, [ebp - 0x644]
add eax, 0x10
mov dword [edi], eax
call fcn.00468050
lea ebx, [esi - 0x10]
mov byte [ebp - 4], 0x3e
push ebx
mov dword [ebp - 0x6ac], ebx
call fcn.004293f0
add eax, 0x10
add esp, 4
mov dword [ebp - 0x6a0], eax
push 1
push 0x5ad728
lea ecx, [ebp - 0x6a0]
mov byte [ebp - 4], 0x3f
call fcn.00429240
push 8
push str.wpsdrive
lea ecx, [ebp - 0x6a0]
call fcn.00429240
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4b45d5
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x668], esi
mov edi, dword [ebp - 0x6a0]
lea eax, [ebp - 0x664]
push eax
push edi
push 0x80000001
mov byte [ebp - 4], 0x41
mov dword [ebp - 0x664], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x660], 0
test eax, eax
je 0x4b41fe
lea ecx, [ebp - 0x660]
push ecx
push 0
lea ecx, [ebp - 0x680]
push ecx
push 0
push str.driveRootPath
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x680]
cmp eax, 1
je 0x4b414e
cmp eax, 2
jne 0x4b41ed
lea ecx, [ebp - 0x668]
call fcn.00429490
mov ecx, dword [ebp - 0x660]
shr ecx, 1
add ecx, 1
js 0x4b45bc
mov esi, dword [ebp - 0x668]
mov edx, 1
mov eax, dword [esi - 8]
sub edx, dword [esi - 4]
sub eax, ecx
or eax, edx
jge 0x4b4193
push ecx
lea ecx, [ebp - 0x668]
call fcn.004296d0
mov esi, dword [ebp - 0x668]
lea eax, [ebp - 0x660]
push eax
push esi
lea eax, [ebp - 0x680]
push eax
push 0
push str.driveRootPath
push dword [ebp - 0x664]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b41ed
mov eax, dword [ebp - 0x660]
xor ecx, ecx
shr eax, 1
mov word [esi + eax*2], cx
push dword [esi - 8]
push esi
call fcn.00555593
add esp, 8
test eax, eax
js 0x4b45bc
cmp eax, dword [esi - 8]
jg 0x4b45bc
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov eax, dword [ebp - 0x664]
test eax, eax
je 0x4b41fe
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x664], 0
cmp dword [esi - 0xc], 0
je 0x4b42a7
push ecx
mov ecx, esp
mov dword [ebp - 0x6b0], esp
push str.WPSDrive
call fcn.004435d0
push ecx
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0x42
mov ebx, esp
push eax
mov dword [ebp - 0x6c8], ebx
call fcn.004293f0
add esp, 4
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0x41
call fcn.004aad20
add esp, 8
test eax, eax
je 0x4b4290
lea eax, [ebp - 0x680]
mov dword [ebp - 0x680], 0
push eax
push 1
push 1
push esi
call fcn.00474ee0
push dword [ebp - 0x680]
push str.814_tkuserinfo::uninstallQing_tDeleteFolder_count:_d
push str.H:_rc_v11_i18n_20230711_branchCoding_support_newsetup_srccommonappKUninstallkuserinfo.cpp
push str._INFO_
push 0x631888
call fcn.004677c0
add esp, 0x24
mov eax, dword [ebp - 0x664]
test eax, eax
je 0x4b42a1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x6ac]
mov dword [ebp - 0x664], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 0x3f
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4b42cd
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
or esi, 0xffffffff
mov byte [ebp - 4], 0x3e
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4b42eb
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x644]
call fcn.00468130
mov edx, dword [ebp - 0x684]
mov eax, esi
mov byte [ebp - 4], 0x18
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b4314
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x17
mov eax, esi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x4b432c
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x6bc]
mov byte [ebp - 4], 0x14
test eax, eax
je 0x4b4341
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x690]
jmp 0x4b434c
or esi, 0xffffffff
push str.config.ini
lea eax, [ebp - 0x6a8]
push eax
lea eax, [ebp - 0x684]
push eax
call fcn.00429080
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0xc
push dword [eax]
call ebx
mov edx, dword [ebp - 0x684]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b438e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str._filecache
lea eax, [ebp - 0x6a8]
push eax
lea eax, [ebp - 0x684]
push eax
call fcn.00429080
push 0
push 1
push 1
push dword [eax]
mov byte [ebp - 4], 0x43
call fcn.00474ee0
mov edx, dword [ebp - 0x684]
add esp, 0x1c
mov byte [ebp - 4], 0x14
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b43db
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.004409a0
test eax, eax
je 0x4b446c
lea eax, [ebp - 0x674]
mov ecx, 0x6319b8
push eax
call fcn.0048b470
push 0x27
push str.KingsoftWPS_Cloud_Filesuserdataqing
lea ecx, [ebp - 0x674]
mov byte [ebp - 4], 0x44
call fcn.00429240
push str.config.ini
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x684]
push eax
call fcn.00429080
add esp, 0xc
push dword [eax]
call ebx
mov edx, dword [ebp - 0x684]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b444b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x674]
mov eax, esi
mov byte [ebp - 4], 0x14
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b446c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x12
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4b4487
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x65c]
call fcn.0042a1f0
mov edx, dword [ebp - 0x6a4]
mov eax, esi
mov byte [ebp - 4], 0x10
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b44d0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4b44d0
push dword [ebp - 0x6c0]
push 0x5ad78c
push str.autologin
push str.General
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x5b0698
push str.SOFTWAREKingsoft
push 0
call fcn.004a7cb0
push str.WPSCloud
push str.SOFTWAREKingsoft
push dword [ebp + 8]
call fcn.004a7cb0
mov edx, dword [ebp - 0x6c0]
add esp, 0x18
mov byte [ebp - 4], 0xf
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b4517
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x6a8]
mov eax, esi
mov byte [ebp - 4], 4
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b4538
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x698]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x4b455a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00545ec7
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80070057
call fcn.004293d0
push 0x80004005
call fcn.004293d0
call fcn.00555394
push 0x80004005
call fcn.004293d0
int3