Function at 0x4868c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c9a0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x61ce74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004865b0
test al, al
jne 0x486b6d
mov ecx, esi
call fcn.00486c70
test al, al
jne 0x486b6d
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x486b81
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
call fcn.004e38e0
mov ecx, dword [ebp - 0x10]
mov ebx, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ecx, ecx
je 0x486949
push ecx
call edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push str.KingsoftOffice6.0CommonUserInfo
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [ebp - 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x18], 0
test eax, eax
je 0x486a20
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
push str.ACUPI
push eax
call ebx
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x48699d
cmp eax, 2
jne 0x486a1d
lea ecx, [ebp - 0x14]
call fcn.00426010
mov edx, dword [ebp - 0x18]
shr edx, 1
add edx, 1
js 0x486b8b
mov esi, dword [ebp - 0x14]
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x4869d3
push edx
lea ecx, [ebp - 0x14]
call fcn.00426250
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push 0
push str.ACUPI
push dword [ebp - 0x10]
call ebx
test eax, eax
jne 0x486a1d
mov eax, dword [ebp - 0x18]
xor ecx, ecx
shr eax, 1
mov word [esi + eax*2], cx
push dword [esi - 8]
push esi
call fcn.0054b2c2
add esp, 8
test eax, eax
js 0x486b8b
cmp eax, dword [esi - 8]
jg 0x486b8b
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov eax, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
jne 0x486b06
test eax, eax
je 0x486a31
push eax
call edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push str.KingsoftOffice6.0CommonUserInfo
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], 0
test eax, eax
je 0x486b0d
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
push str.ACUPI
push eax
call ebx
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x486a83
cmp eax, 2
jne 0x486b03
lea ecx, [ebp - 0x14]
call fcn.00426010
mov ecx, dword [ebp - 0x18]
shr ecx, 1
add ecx, 1
js 0x486b8b
mov esi, dword [ebp - 0x14]
mov edx, 1
mov eax, dword [esi - 8]
sub edx, dword [esi - 4]
sub eax, ecx
or eax, edx
jge 0x486ab9
push ecx
lea ecx, [ebp - 0x14]
call fcn.00426250
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push 0
push str.ACUPI
push dword [ebp - 0x10]
call ebx
test eax, eax
jne 0x486b03
mov eax, dword [ebp - 0x18]
xor ecx, ecx
shr eax, 1
mov word [esi + eax*2], cx
push dword [esi - 8]
push esi
call fcn.0054b2c2
add esp, 8
test eax, eax
js 0x486b8b
cmp eax, dword [esi - 8]
jg 0x486b8b
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x486b0d
push eax
call edi
push str.true
push esi
mov dword [ebp - 0x10], 0
call fcn.0054b581
xor ebx, ebx
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x10]
sete bl
test eax, eax
je 0x486b33
push eax
call edi
mov dword [ebp - 0x10], 0
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x486b59
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00425f50
push 0x80070057
call fcn.00425f50
int3