Function at 0x484db0
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Create process on windows
Read .ini file
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f79b
mov eax, dword fs:[0]
push eax
sub esp, 0x360
mov eax, dword [0x5fb61c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x5fcb00]
mov edx, dword [eax + 0xc]
mov esi, ecx
mov ecx, 0x5fcb00
call edx
add eax, 0x10
mov dword [ebp - 0x36c], eax
mov eax, dword [0x5fcb00]
mov edx, dword [eax + 0xc]
xor edi, edi
mov ecx, 0x5fcb00
mov dword [ebp - 4], edi
call edx
add eax, 0x10
mov dword [ebp - 0x354], eax
mov eax, dword [0x5fcb00]
mov edx, dword [eax + 0xc]
mov ecx, 0x5fcb00
mov byte [ebp - 4], 1
call edx
add eax, 0x10
mov dword [ebp - 0x344], eax
mov edx, dword [0x5fcb00]
xor eax, eax
mov word [ebp - 0x18], ax
mov eax, dword [edx + 0xc]
mov ecx, 0x5fcb00
mov byte [ebp - 4], 2
mov dword [ebp - 0x16], edi
call eax
add eax, 0x10
mov dword [ebp - 0x348], eax
push 0x206
lea edx, [ebp - 0x21e]
xor ecx, ecx
push edi
push edx
mov byte [ebp - 4], 3
mov word [ebp - 0x220], cx
call fcn.005336c0
mov eax, dword [0x5fcb00]
mov edx, dword [eax + 0xc]
add esp, 0xc
mov ecx, 0x5fcb00
call edx
add eax, 0x10
mov dword [ebp - 0x358], eax
mov eax, dword [0x5fcb00]
mov edx, dword [eax + 0xc]
mov ecx, 0x5fcb00
mov byte [ebp - 4], 4
call edx
add eax, 0x10
mov dword [ebp - 0x350], eax
mov eax, dword [0x5fcb00]
mov edx, dword [eax + 0xc]
mov ecx, 0x5fcb00
mov byte [ebp - 4], 5
call edx
add eax, 0x10
mov dword [ebp - 0x35c], eax
mov ecx, dword [str.SoftwarekingsoftOffice6.0Common]
lea eax, [ebp - 0x364]
push eax
push ecx
push 0x80000002
mov byte [ebp - 4], 7
mov dword [ebp - 0x364], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, edi
jne 0x484f07
lea edx, [ebp - 0x35c]
push edx
push str.DistSrc
lea ecx, [ebp - 0x364]
call fcn.00439630
lea ecx, [ebp - 0x338]
call fcn.004984c0
push 0x5a3048
lea ecx, [ebp - 0x360]
mov byte [ebp - 4], 8
call fcn.00422540
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 9
call fcn.00498fd0
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0xa
jb 0x484f4a
mov edx, dword [eax]
jmp 0x484f4c
mov edx, eax
cmp edx, edi
jne 0x484f54
xor eax, eax
jmp 0x484f6f
mov eax, edx
lea ebx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x484f60
sub eax, ebx
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x360]
call fcn.00422060
cmp dword [ebp - 0x244], 8
mov byte [ebp - 4], 9
jb 0x484f98
mov ecx, dword [ebp - 0x258]
push ecx
call int.0042bfd0
add esp, 4
push 1
push 0x5a3044
lea ecx, [ebp - 0x360]
call fcn.00422060
mov ebx, dword [0x5f2d8c]
cmp dword [esi + 0x50], edi
je 0x48509f
mov edx, dword [0x5fcb00]
mov eax, dword [edx + 0xc]
mov ecx, 0x5fcb00
call eax
add eax, 0x10
mov dword [ebp - 0x33c], eax
mov ecx, str.Preparing_to_uninstall
mov byte [ebp - 4], 0xb
test ecx, 0xffff0000
jne 0x485011
mov edx, ecx
movzx eax, dx
push edi
push eax
mov dword [ebp - 0x368], eax
call fcn.004219f0
add esp, 8
cmp eax, edi
je 0x485021
mov ecx, dword [ebp - 0x368]
push ecx
push eax
lea ecx, [ebp - 0x33c]
call fcn.00421f40
jmp 0x485021
push str.Preparing_to_uninstall
lea ecx, [ebp - 0x33c]
call fcn.00442cf0
lea edx, [ebp - 0x33c]
push edx
lea eax, [ebp - 0x340]
push eax
mov ecx, 0x5ffab8
mov byte [ebp - 4], 0xc
call fcn.0049a1d0
mov ecx, dword [esi + 0x28]
mov eax, dword [eax]
mov edx, dword [esi + 0x50]
push ecx
push eax
push edi
push edi
push ebx
mov byte [ebp - 4], 0xd
call edx
mov eax, dword [ebp - 0x340]
add eax, 0xfffffff0
add esp, 0x14
mov byte [ebp - 4], 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485079
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x33c]
add eax, 0xfffffff0
mov byte [ebp - 4], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48509f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi + 0xf4]
cmp dword [ecx - 0xc], edi
je 0x4851db
mov eax, dword [esi + 0xf8]
cmp dword [eax - 4], 1
jle 0x4850c9
mov edx, dword [eax - 0xc]
push edx
lea ecx, [esi + 0xf8]
call fcn.00421b90
mov edi, dword [esi + 0xf8]
xor eax, eax
mov word [ebp - 0x258], ax
mov eax, edi
mov dword [ebp - 0x244], 7
mov dword [ebp - 0x248], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4850f1
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0x258]
call fcn.00437a20
mov eax, dword [esi + 0xf4]
cmp dword [eax - 4], 1
mov byte [ebp - 4], 0xe
jle 0x48512c
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [esi + 0xf4]
call fcn.00421b90
mov ebx, dword [esi + 0xf4]
xor edx, edx
mov edi, 7
mov eax, ebx
mov word [ebp - 0x23c], dx
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x22c], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x485155
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [ebp - 0x23c]
call fcn.00437a20
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x23c]
push ecx
mov byte [ebp - 4], 0xf
call fcn.00495930
mov ebx, 8
add esp, 8
cmp dword [ebp - 0x228], ebx
jb 0x4851a7
mov edx, dword [ebp - 0x23c]
push edx
call int.0042bfd0
add esp, 4
xor eax, eax
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x22c], 0
mov word [ebp - 0x23c], ax
mov byte [ebp - 4], 9
cmp dword [ebp - 0x244], ebx
jb 0x4851db
mov ecx, dword [ebp - 0x258]
push ecx
call int.0042bfd0
add esp, 4
call fcn.0046b040
cmp dword [esi + 0xd8], 0
mov ecx, esi
je 0x48522f
lea edx, [ebp - 0x340]
push edx
call fcn.0047aa60
lea ecx, [esi + 0xc0]
push eax
mov byte [ebp - 4], 0x10
call fcn.004222b0
mov eax, dword [ebp - 0x340]
add eax, 0xfffffff0
mov byte [ebp - 4], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485234
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x485234
call fcn.0047d6e0
mov eax, dword [esi + 0x10]
lea edi, [esi + 0x10]
sub eax, 0x10
push eax
call fcn.00421e00
add eax, 0x10
mov dword [ebp - 0x34c], eax
lea ecx, [ebp - 0x34c]
push ecx
mov byte [ebp - 4], 0x11
call fcn.0046eb60
add esp, 8
push 0x13
push str.utilityinstall.ini
lea ecx, [ebp - 0x34c]
call fcn.00422060
xor eax, eax
mov dword [ebp - 0x232], eax
mov dword [ebp - 0x22e], eax
mov dword [ebp - 0x22a], eax
mov dword [ebp - 0x226], eax
mov word [ebp - 0x222], ax
mov eax, dword [ebp - 0x34c]
push eax
push 0xa
lea ecx, [ebp - 0x234]
push ecx
push str.false
push str.InstallPerUser
xor edx, edx
push 0x5a0fb4
mov word [ebp - 0x234], dx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x234]
push str.true
push edx
call fcn.005347c1
add esp, 8
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0xdc], eax
mov eax, dword [ebp - 0x34c]
push eax
push str.false
push str.needAdmin
push 0x5a0fb4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x368], eax
mov eax, dword [edi]
push eax
lea ecx, [ebp - 0x36c]
call fcn.0046ab70
test eax, eax
je 0x4859db
push str.uninstall_begin...
push 0x5ff5f8
mov dword [esi + 8], 0
call fcn.00477930
mov ebx, dword [str._FPcd]
add esp, 8
cmp dword [esi + 0x50], 0
je 0x4853d6
push str.Performing_the_preparation_before_uninstallation
lea ecx, [ebp - 0x33c]
call fcn.004433f0
lea ecx, [ebp - 0x33c]
push ecx
lea edx, [ebp - 0x340]
push edx
mov ecx, 0x5ffab8
mov byte [ebp - 4], 0x12
call fcn.0049a1d0
mov ecx, dword [esi + 0x28]
mov eax, dword [eax]
mov edx, dword [esi + 0x50]
push ecx
push eax
push 0
push 1
push ebx
mov byte [ebp - 4], 0x13
call edx
mov eax, dword [ebp - 0x340]
add eax, 0xfffffff0
add esp, 0x14
mov byte [ebp - 4], 0x12
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4853b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x33c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4853d6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, esi
call fcn.00481870
test eax, eax
jne 0x48547e
cmp dword [esi + 0x50], eax
je 0x48547e
push str.Failed_to_perform_the_preparation_before_uninstallation
lea ecx, [ebp - 0x33c]
call fcn.004433f0
lea ecx, [ebp - 0x33c]
push ecx
lea edx, [ebp - 0x340]
push edx
mov ecx, 0x5ffab8
mov byte [ebp - 4], 0x14
call fcn.0049a1d0
mov ecx, dword [esi + 0x28]
mov eax, dword [eax]
mov edx, dword [esi + 0x50]
push ecx
push eax
push 2
push 1
push ebx
mov byte [ebp - 4], 0x15
call edx
mov eax, dword [ebp - 0x340]
add eax, 0xfffffff0
add esp, 0x14
mov byte [ebp - 4], 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485458
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x33c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48547e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esi + 0x50], 0
mov ebx, dword [0x5f2d94]
je 0x48551e
push str.Deleting_files
lea ecx, [ebp - 0x33c]
call fcn.004433f0
lea ecx, [ebp - 0x33c]
push ecx
lea edx, [ebp - 0x340]
push edx
mov ecx, 0x5ffab8
mov byte [ebp - 4], 0x16
call fcn.0049a1d0
mov ecx, dword [esi + 0x28]
mov eax, dword [eax]
mov edx, dword [esi + 0x50]
push ecx
push eax
push 0
push 2
push ebx
mov byte [ebp - 4], 0x17
call edx
mov eax, dword [ebp - 0x340]
add eax, 0xfffffff0
add esp, 0x14
mov byte [ebp - 4], 0x16
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4854f8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x33c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48551e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
lea ecx, [ebp - 0x344]
call fcn.004222b0
lea ecx, [ebp - 0x344]
push ecx
call fcn.0046eb60
add esp, 4
push 0x13
push str.office6KsoPost.exe
lea ecx, [ebp - 0x344]
call fcn.00422060
lea edx, [ebp - 0x350]
push edx
mov ecx, esi
call fcn.0047bdf0
push 0xb
push str.KsoPost.exe
lea ecx, [ebp - 0x350]
call fcn.00422060
mov eax, dword [ebp - 0x344]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x485592
mov ecx, dword [ebp - 0x350]
mov edx, dword [ebp - 0x344]
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push edi
lea ecx, [ebp - 0x348]
call fcn.004222b0
lea eax, [ebp - 0x348]
push eax
call fcn.0046eb60
add esp, 4
push 0x13
push str.utilityinstall.ini
lea ecx, [ebp - 0x348]
call fcn.00422060
mov ecx, dword [ebp - 0x348]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push ecx
push 3
lea edx, [ebp - 0x18]
push edx
push 0x592368
push str.withKsoPost
push str.installinfo
call ebx
push edi
lea ecx, [ebp - 0x358]
call fcn.004222b0
lea eax, [ebp - 0x358]
push eax
call fcn.0046eb60
add esp, 4
push 0x16
push str.office6cfgs_setup.cfg
lea ecx, [ebp - 0x358]
call fcn.00422060
mov ecx, dword [ebp - 0x358]
push ecx
push 0x104
lea edx, [ebp - 0x220]
push edx
push 0x591ff8
push str.Version
push str.version
call ebx
push 0
call fcn.0046b180
add esp, 4
mov ecx, esi
call fcn.0047edf0
mov ecx, esi
call fcn.0047f490
cmp dword [esi + 0x50], 0
mov ebx, dword [0x5f2d98]
je 0x4856ec
push str.Deleting_files
lea ecx, [ebp - 0x33c]
call fcn.004433f0
lea eax, [ebp - 0x33c]
push eax
lea ecx, [ebp - 0x340]
push ecx
mov ecx, 0x5ffab8
mov byte [ebp - 4], 0x18
call fcn.0049a1d0
mov edx, dword [esi + 0x28]
mov eax, dword [eax]
push edx
push eax
mov eax, dword [esi + 0x50]
push 0
push 3
push ebx
mov byte [ebp - 4], 0x19
call eax
mov eax, dword [ebp - 0x340]
add eax, 0xfffffff0
add esp, 0x14
mov byte [ebp - 4], 0x18
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4856c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x33c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4856ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, esi
call fcn.0047d210
push str.start_delete_old_version_product
push 0x5ff5f8
call fcn.00477930
add esp, 8
cmp dword [esi + 0xd8], 0
je 0x485722
lea ecx, [esi + 0xc0]
push ecx
lea ecx, [ebp - 0x354]
call fcn.004222b0
jmp 0x485766
lea edx, [ebp - 0x340]
push edx
mov ecx, esi
call fcn.0047c2f0
push eax
lea ecx, [ebp - 0x354]
mov byte [ebp - 4], 0x1a
call fcn.004222b0
mov eax, dword [ebp - 0x340]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485766
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x354]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x340], esp
mov ebx, esp
push eax
call fcn.00421e00
add eax, 0x10
add esp, 4
mov ecx, esi
mov dword [ebx], eax
call fcn.0047d9a0
mov ecx, dword [ebp - 0x354]
push ecx
push str.end_delete_old_version__ws__product
push 0x5ff5f8
call fcn.00477930
push 1
call fcn.0046b180
add esp, 0x10
lea ecx, [esi + 0x2c]
call fcn.00477290
push str.office6werhandler.dll
lea edx, [ebp - 0x340]
push edi
push edx
call fcn.004221d0
mov eax, dword [eax]
push eax
mov byte [ebp - 4], 0x1b
call fcn.00442860
mov eax, dword [ebp - 0x340]
add eax, 0xfffffff0
add esp, 0x10
mov byte [ebp - 4], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4857fc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esi + 0x50], 0
mov edi, dword [0x5f2d9c]
je 0x48589c
push str.Unregistering
lea ecx, [ebp - 0x33c]
call fcn.004433f0
lea ecx, [ebp - 0x33c]
push ecx
lea edx, [ebp - 0x340]
mov bl, 0x1c
push edx
mov ecx, 0x5ffab8
mov byte [ebp - 4], bl
call fcn.0049a1d0
mov ecx, dword [esi + 0x28]
mov eax, dword [eax]
mov edx, dword [esi + 0x50]
push ecx
push eax
push 0
push 4
push edi
mov byte [ebp - 4], 0x1d
call edx
mov eax, dword [ebp - 0x340]
add eax, 0xfffffff0
add esp, 0x14
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485876
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x33c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48589c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esi + 4], 0
jne 0x4859bf
mov ecx, 0x595524
lea eax, [ebp - 0x18]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4858d6
test dx, dx
je 0x4858d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4858d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4858b0
xor eax, eax
jmp 0x4858db
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4859bf
call fcn.0043f620
test eax, eax
je 0x485904
push 1
push str.WithKsoPost
call fcn.0045a830
add esp, 8
cmp eax, 1
jne 0x4859bf
push str._u__GUID___p__PipeName___n_kso__v__InstalledBuildVersion___i_0
lea ecx, [ebp - 0x33c]
call fcn.00422540
mov ecx, dword [ebp - 0x360]
push ecx
push str._GUID_
lea ecx, [ebp - 0x33c]
mov byte [ebp - 4], 0x1e
call fcn.0045b6e0
lea edx, [ebp - 0x220]
push edx
push str._InstalledBuildVersion_
lea ecx, [ebp - 0x33c]
call fcn.0045b6e0
mov eax, dword [ebp - 0x35c]
cmp dword [eax - 0xc], 0
jne 0x485962
push str.00001.00000002
lea ecx, [ebp - 0x35c]
call fcn.00422390
mov ecx, dword [ebp - 0x35c]
push ecx
push str._PipeName_
lea ecx, [ebp - 0x33c]
call fcn.0045b6e0
mov edx, dword [ebp - 0x33c]
mov eax, dword [ebp - 0x350]
push 0
push 1
push 0
push 1
push 0
push edx
push eax
call fcn.00471f30
mov eax, dword [ebp - 0x33c]
add eax, 0xfffffff0
add esp, 0x1c
mov byte [ebp - 4], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4859bf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, esi
call fcn.00484d20
mov ecx, esi
call fcn.0047b6a0
mov ecx, esi
call fcn.0047dbd0
mov dword [esi + 8], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x368]
cmp dword [esi + 0x50], 0
mov dword [esi + 0x4c], eax
mov edi, dword [0x5f2da0]
je 0x485ad4
cmp dword [esi + 8], 0
je 0x485ad4
push str.Uninstallation_completed
lea ecx, [ebp - 0x33c]
call fcn.004433f0
lea ecx, [ebp - 0x33c]
push ecx
lea edx, [ebp - 0x340]
mov bl, 0x1f
push edx
mov ecx, 0x5ffab8
mov byte [ebp - 4], bl
call fcn.0049a1d0
mov ecx, dword [esi + 0x28]
mov eax, dword [eax]
mov edx, dword [esi + 0x50]
push ecx
push eax
push 0
push 5
push edi
mov byte [ebp - 4], 0x20
call edx
mov eax, dword [ebp - 0x340]
add eax, 0xfffffff0
add esp, 0x14
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485a6e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x33c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485a94
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0xcc]
cmp dword [eax - 0xc], 0
je 0x485ad4
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push 0
push 0
push eax
push str.open
push 0
call edi
cmp eax, 0x20
jg 0x485ad4
mov eax, dword [esi + 0xcc]
push 1
push 0
push eax
push str.iexplore
push str.open
push 0
call edi
cmp dword [esi + 0x48], 0
je 0x485b0a
push str.wait_wpsmain
push 0x5ff5f8
call fcn.00477930
mov ecx, dword [esi + 0x48]
add esp, 8
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.wait_wpsmain_end
push 0x5ff5f8
call fcn.00477930
add esp, 8
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 8]
push edx
push eax
push str.uninstall_end__return:_d__install_cost_time:_dms
push 0x5ff5f8
call fcn.00477930
mov eax, dword [ebp - 0x34c]
add eax, 0xfffffff0
add esp, 0x10
mov byte [ebp - 4], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485b4a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x360]
add eax, 0xfffffff0
mov byte [ebp - 4], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485b70
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x338]
call fcn.00478760
mov eax, dword [ebp - 0x364]
test eax, eax
je 0x485b8c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x35c]
add eax, 0xfffffff0
mov dword [ebp - 0x364], 0
mov byte [ebp - 4], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485bbc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x350]
add eax, 0xfffffff0
mov byte [ebp - 4], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485be2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x358]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485c08
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x348]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485c2e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x344]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485c54
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x354]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485c7a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x36c]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485ca3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005332ca
mov esp, ebp
pop ebp
ret