Function at 0x43a570
Capabilities:
Get installed programs

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578e78
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5fb61c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x5fcb00]
mov edx, dword [eax + 0xc]
mov ecx, 0x5fcb00
call edx
add eax, 0x10
mov dword [ebp - 0x24], eax
or edi, 0xffffffff
xor ebx, ebx
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call fcn.00439e70
mov eax, dword [str.SoftwareKingsoftOffice]
push str.languages
push eax
push 0x80000001
mov dword [ebp - 4], 1
call fcn.0045c5d0
mov ecx, dword [str.SoftwareKingsoftOffice]
push str.mui_file_list
push ecx
push 0x80000001
call fcn.0045c5d0
mov edx, dword [str.SoftwareKingsoftOffice]
push 0x5955c0
push edx
push 0x80000001
call fcn.0045c500
mov eax, dword [str.SoftwareKingsoftOfficeWPS]
push str.AddinsCL
push eax
push 0x80000001
call fcn.0045c500
mov ecx, dword [str.SoftwareKingsoftOfficeET]
push str.AddinsCL
push ecx
push 0x80000001
call fcn.0045c500
mov edx, dword [str.SoftwareKingsoftOfficeWPP]
push str.AddinsCL
push edx
push 0x80000001
call fcn.0045c500
add esp, 0x48
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 2
call fcn.004387f0
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
mov dword [ebp - 4], edi
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a682
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x10], ebx
mov edx, dword [0x5fcb00]
mov eax, dword [edx + 0xc]
mov ecx, 0x5fcb00
mov dword [ebp - 4], 3
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov esi, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallKingsoft_Office]
mov byte [ebp - 4], 4
cmp eax, ebx
je 0x43a6ba
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x10]
push ecx
push esi
push 0x80000002
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea edx, [ebp - 0x14]
push edx
push str.IsAllUninstall
lea ecx, [ebp - 0x10]
call fcn.00439630
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x43a6ec
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
mov ecx, str.true
mov eax, esi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43a726
cmp dx, bx
je 0x43a722
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43a726
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x43a700
xor eax, eax
jmp 0x43a72a
sbb eax, eax
sbb eax, edi
cmp eax, ebx
sete al
cmp al, bl
je 0x43a74b
mov eax, dword [str.SoftwareKingsoftOffice]
push 0x5955c0
push eax
push 0x80000001
call fcn.0045c500
add esp, 0xc
lea eax, [esi - 0x10]
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x43a768
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x43a776
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret