Function at 0x4970d0
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1712
mov eax, dword fs:[0]
push eax
sub esp, 0x5ec
mov eax, dword [0x63434c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [0x63d0e4], 0
je 0x49713c
push 0
push 0
push 0x5b5110
push str.StepPreUninstallBegin
push 1
call fcn.004d44b0
add esp, 0x14
cmp byte [0x63d0e4], 0
je 0x49713c
push 0xff
push str.StepPreUninstallBegin
call fcn.004d4530
add esp, 8
mov dword [ebp - 4], 0
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x49877d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x5c4], eax
mov dword [ebp - 4], 2
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x49877d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x580], eax
mov byte [ebp - 4], 4
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x49877d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x56c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov byte [ebp - 4], 6
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x49877d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x57c], eax
push 0x208
lea eax, [ebp - 0x234]
push 0
push eax
call fcn.0055c530
add esp, 0xc
mov byte [ebp - 4], 8
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x49877d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x578], eax
mov byte [ebp - 4], 0xa
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x49877d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x574], eax
lea eax, [ebp - 0x5c8]
mov byte [ebp - 4], 0xb
push eax
mov ecx, edi
call fcn.00494830
lea ecx, [ebp - 0x5f8]
mov byte [ebp - 4], 0xc
call fcn.004d1c00
mov byte [ebp - 4], 0xd
call fcn.0047dc20
mov dword [ebp - 0x5c0], eax
test eax, eax
je 0x49728c
cmp dword [edi + 0x20], 0
jne 0x49728c
push str.1364_tKUninstall::RealUninstallFunc_tis_Hp_preInstall_and_not_save_UserInfo
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x10
lea eax, [edi + 0x10]
lea ecx, [ebp - 0x5f8]
push eax
call fcn.004d34b0
mov byte [ebp - 4], 0xe
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x49877d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x568], eax
lea eax, [ebp - 0x594]
mov byte [ebp - 4], 0x10
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x20019
push 0
push dword [0x60e4a0]
mov dword [ebp - 0x594], 0
push 0x80000002
mov dword [ebp - 0x5e4], eax
call eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x5e8], ebx
test eax, eax
jne 0x4973de
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x564], 0
test eax, eax
je 0x4973de
lea ecx, [ebp - 0x564]
push ecx
push 0
lea ecx, [ebp - 0x560]
push ecx
push 0
push str.DistSrc
push eax
call ebx
mov eax, dword [ebp - 0x560]
cmp eax, 1
je 0x49733b
cmp eax, 2
jne 0x4973de
lea ecx, [ebp - 0x568]
call fcn.00429bc0
mov edx, dword [ebp - 0x564]
shr edx, 1
add edx, 1
js 0x498791
mov esi, dword [ebp - 0x568]
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x497380
push edx
lea ecx, [ebp - 0x568]
call fcn.00429e50
mov esi, dword [ebp - 0x568]
lea eax, [ebp - 0x564]
push eax
push esi
lea eax, [ebp - 0x560]
push eax
push 0
push str.DistSrc
push dword [ebp - 0x594]
call ebx
test eax, eax
jne 0x4973de
mov eax, dword [ebp - 0x564]
xor ecx, ecx
shr eax, 1
mov word [esi + eax*2], cx
test esi, esi
jne 0x4973b8
xor eax, eax
jmp 0x4973cc
push dword [esi - 8]
push esi
call fcn.00566c13
add esp, 8
test eax, eax
js 0x498791
cmp eax, dword [esi - 8]
jg 0x498791
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea ecx, [ebp - 0x55c]
call fcn.004bf840
mov byte [ebp - 4], 0x11
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x498787
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x564], eax
mov eax, 0x5c09cc
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x564]
test eax, 0xffff0000
jne 0x49742b
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x497437
push 1
push 0x5c09cc
call fcn.0042a000
lea eax, [ebp - 0x484]
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0x55c]
call fcn.004c0500
mov edx, eax
cmp dword [edx + 0x14], 8
mov byte [ebp - 4], 0x14
jb 0x49745b
mov edx, dword [edx]
test edx, edx
jne 0x497463
xor ecx, ecx
jmp 0x49747f
mov ecx, edx
lea esi, [ecx + 2]
jmp 0x497470
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x497470
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x564]
call fcn.00429970
mov edx, dword [ebp - 0x470]
mov byte [ebp - 4], 0x13
cmp edx, 8
jb 0x4974d0
mov ecx, dword [ebp - 0x484]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4974c6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49879b
push edx
push ecx
call fcn.00558004
add esp, 8
push 1
push 0x5c09d0
lea ecx, [ebp - 0x564]
call fcn.00429970
mov eax, dword [0x60e468]
or ebx, 0xffffffff
mov dword [ebp - 0x560], eax
mov eax, dword [edi + 0x50]
mov dword [ebp - 0x5b8], eax
test eax, eax
je 0x497588
mov esi, dword [edi + 0x28]
lea ecx, [ebp - 0x588]
push str.Preparing_to_uninstall
call fcn.00444960
lea eax, [ebp - 0x588]
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp - 0x598]
mov ecx, 0x63cf7c
push eax
call fcn.004c42e0
push esi
push dword [eax]
mov byte [ebp - 4], 0x16
push 0
push 0
push dword [ebp - 0x560]
call dword [ebp - 0x5b8]
mov edx, dword [ebp - 0x598]
add esp, 0x14
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x497567
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x588]
mov eax, ebx
mov byte [ebp - 4], 0x13
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x497588
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi + 0xfc]
cmp dword [eax - 0xc], 0
je 0x497784
lea eax, [edi + 0x10]
push eax
lea eax, [ebp - 0x49c]
push eax
call fcn.0049fef0
add esp, 8
mov dword [ebp - 0x5b8], eax
mov edx, dword [edi + 0x100]
mov byte [ebp - 4], 0x17
cmp dword [edx - 4], 1
jle 0x4975d5
push dword [edx - 0xc]
lea ecx, [edi + 0x100]
call fcn.00429c70
mov edx, dword [edi + 0x100]
mov ecx, edx
mov dword [ebp - 0x454], 0
xor eax, eax
mov dword [ebp - 0x444], 0
mov word [ebp - 0x454], ax
mov dword [ebp - 0x440], 7
lea eax, [ecx + 2]
mov dword [ebp - 0x598], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x497607
sub ecx, dword [ebp - 0x598]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x454]
call fcn.0042e2d0
mov edx, dword [edi + 0xfc]
mov byte [ebp - 4], 0x18
cmp dword [edx - 4], 1
jle 0x49764b
push dword [edx - 0xc]
lea ecx, [edi + 0xfc]
call fcn.00429c70
mov edx, dword [edi + 0xfc]
mov ecx, edx
mov dword [ebp - 0x46c], 0
xor eax, eax
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 7
mov word [ebp - 0x46c], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x497677
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x46c]
call fcn.0042e2d0
push dword [ebp - 0x5b8]
lea eax, [ebp - 0x454]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x46c]
push eax
call fcn.004b87a0
mov edx, dword [ebp - 0x458]
add esp, 0xc
mov byte [ebp - 4], 0x18
cmp edx, 8
jb 0x4976f7
mov ecx, dword [ebp - 0x46c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4976ed
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4987a0
push edx
push ecx
call fcn.00558004
add esp, 8
mov edx, dword [ebp - 0x440]
xor eax, eax
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 7
mov word [ebp - 0x46c], ax
mov byte [ebp - 4], 0x17
cmp edx, 8
jb 0x497758
mov ecx, dword [ebp - 0x454]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x49774e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4987a0
push edx
push ecx
call fcn.00558004
add esp, 8
xor eax, eax
mov dword [ebp - 0x444], 0
lea ecx, [ebp - 0x49c]
mov dword [ebp - 0x440], 7
mov word [ebp - 0x454], ax
mov byte [ebp - 4], 0x13
call fcn.0042aad0
cmp dword [edi + 0xdc], 0
mov ecx, edi
je 0x4977ce
lea eax, [ebp - 0x5ac]
push eax
call fcn.004944e0
push eax
lea ecx, [edi + 0xc4]
mov byte [ebp - 4], 0x1a
call fcn.00429740
mov edx, dword [ebp - 0x5ac]
mov eax, ebx
mov byte [ebp - 4], 0x13
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4977d3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4977d3
call fcn.0049da30
mov eax, dword [edi + 0x10]
sub eax, 0x10
push eax
call fcn.00429b20
add eax, 0x10
mov dword [ebp - 0x570], eax
lea eax, [ebp - 0x570]
mov byte [ebp - 4], 0x1b
push eax
call fcn.0047f130
add esp, 8
lea ecx, [ebp - 0x570]
push 0x13
push str.utilityinstall.ini
call fcn.00429970
push dword [ebp - 0x570]
xor eax, eax
push 0xa
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x5b86ec
push str.InstallPerUser
push str.update
mov dword [ebp - 0x560], eax
call eax
lea eax, [ebp - 0x2c]
push 0x5b6494
push eax
call fcn.00566ed2
add esp, 8
neg eax
sbb eax, eax
inc eax
mov dword [edi + 0xe0], eax
push dword [ebp - 0x570]
push 0x5b86ec
push str.needAdmin
push str.update
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [edi + 0x10]
lea ecx, [ebp - 0x5c4]
mov dword [ebp - 0x598], eax
call fcn.00476c30
test eax, eax
je 0x498327
mov dword [edi + 8], 0
cmp byte [0x63d0e4], 0
je 0x4978e2
push 0
push 0
push 0x5b5110
push str.StepPreUninstallBegin
push 1
call fcn.004d44f0
add esp, 0x14
cmp byte [0x63d0e4], 0
je 0x4978e2
push 0xff
push str.StepPreUninstallBegin
call fcn.004d4550
add esp, 8
push str.1410_tKUninstall::RealUninstallFunc_tuninstall_begin...
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [str._FPcd]
add esp, 0x10
mov dword [ebp - 0x588], eax
mov eax, dword [edi + 0x50]
mov dword [ebp - 0x5ac], eax
test eax, eax
je 0x4979a1
mov esi, dword [edi + 0x28]
lea ecx, [ebp - 0x5bc]
push str.Performing_the_preparation_before_uninstallation
call fcn.00444960
lea eax, [ebp - 0x5bc]
mov byte [ebp - 4], 0x1c
push eax
lea eax, [ebp - 0x59c]
mov ecx, 0x63cf7c
push eax
call fcn.004c42e0
push esi
push dword [eax]
mov byte [ebp - 4], 0x1d
push 0
push 1
push dword [ebp - 0x588]
call dword [ebp - 0x5ac]
mov edx, dword [ebp - 0x59c]
add esp, 0x14
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x497980
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5bc]
mov eax, ebx
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4979a1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [0x63d0e4], 0
je 0x4979dd
push 0
push 0
push 0x5b5110
push str.StepExecBeforeDeleteFile
push 1
call fcn.004d44b0
add esp, 0x14
cmp byte [0x63d0e4], 0
je 0x4979dd
push 0xff
push str.StepExecBeforeDeleteFile
call fcn.004d4530
add esp, 8
mov ecx, edi
call fcn.00491250
cmp byte [0x63d0e4], 0
mov esi, eax
je 0x497a22
push 0
push 0
push 0x5b5110
push str.StepExecBeforeDeleteFile
push 1
call fcn.004d44f0
add esp, 0x14
cmp byte [0x63d0e4], 0
je 0x497a22
push 0xff
push str.StepExecBeforeDeleteFile
call fcn.004d4550
add esp, 8
test esi, esi
jne 0x497ac2
mov eax, dword [edi + 0x50]
mov dword [ebp - 0x59c], eax
test eax, eax
je 0x497ac2
mov esi, dword [edi + 0x28]
lea ecx, [ebp - 0x5dc]
push str.Failed_to_perform_the_preparation_before_uninstallation
call fcn.00444960
lea eax, [ebp - 0x5dc]
mov byte [ebp - 4], 0x1e
push eax
lea eax, [ebp - 0x5a0]
mov ecx, 0x63cf7c
push eax
call fcn.004c42e0
push esi
push dword [eax]
mov byte [ebp - 4], 0x1f
push 2
push 1
push dword [ebp - 0x588]
call dword [ebp - 0x59c]
mov edx, dword [ebp - 0x5a0]
add esp, 0x14
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x497aa1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5dc]
mov eax, ebx
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x497ac2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x60e470]
mov dword [ebp - 0x5a0], eax
mov eax, dword [edi + 0x50]
mov dword [ebp - 0x59c], eax
test eax, eax
je 0x497b65
mov esi, dword [edi + 0x28]
lea ecx, [ebp - 0x5d8]
push str.Deleting_files
call fcn.00444960
lea eax, [ebp - 0x5d8]
mov byte [ebp - 4], 0x20
push eax
lea eax, [ebp - 0x5b4]
mov ecx, 0x63cf7c
push eax
call fcn.004c42e0
push esi
push dword [eax]
mov byte [ebp - 4], 0x21
push 0
push 2
push dword [ebp - 0x5a0]
call dword [ebp - 0x59c]
mov edx, dword [ebp - 0x5b4]
add esp, 0x14
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x497b44
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5d8]
mov eax, ebx
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x497b65
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea esi, [edi + 0x10]
push esi
lea ecx, [ebp - 0x56c]
call fcn.00429740
lea eax, [ebp - 0x56c]
push eax
call fcn.0047f130
add esp, 4
lea ecx, [ebp - 0x56c]
push 0x13
push str.office6KsoPost.exe
call fcn.00429970
lea eax, [ebp - 0x574]
mov ecx, edi
push eax
call fcn.0049dda0
push 0xb
push str.KsoPost.exe
lea ecx, [ebp - 0x574]
call fcn.00429970
push dword [ebp - 0x56c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x497bd9
push 0
push dword [ebp - 0x574]
push dword [ebp - 0x56c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
lea ecx, [ebp - 0x57c]
call fcn.00429740
lea eax, [ebp - 0x57c]
push eax
call fcn.0047f130
add esp, 4
lea ecx, [ebp - 0x57c]
push 0x13
push str.utilityinstall.ini
call fcn.00429970
push dword [ebp - 0x57c]
lea eax, [ebp - 0x18]
push 3
push eax
push 0x5b4868
push str.withKsoPost
push str.installinfo
call dword [ebp - 0x560]
push esi
lea ecx, [ebp - 0x578]
call fcn.00429740
lea eax, [ebp - 0x578]
push eax
call fcn.0047f130
add esp, 4
lea ecx, [ebp - 0x578]
push 0x16
push str.office6cfgs_setup.cfg
call fcn.00429970
push dword [ebp - 0x578]
lea eax, [ebp - 0x234]
push 0x104
push eax
push 0x5b3734
push str.Version
push 0x5c0b88
call dword [ebp - 0x560]
push 0
call fcn.0047aef0
add esp, 4
cmp byte [0x63d0e4], 0
je 0x497cc1
push 0
push 0
push 0x5b5110
push str.StepDeleteFile
push 1
call fcn.004d44b0
add esp, 0x14
cmp byte [0x63d0e4], 0
je 0x497cc1
push 0xff
push str.StepDeleteFile
call fcn.004d4530
add esp, 8
mov ecx, edi
call fcn.0048f0a0
mov ecx, edi
call fcn.0048c190
mov eax, dword [0x60e474]
mov dword [ebp - 0x5b4], eax
mov eax, dword [edi + 0x50]
mov dword [ebp - 0x5a0], eax
test eax, eax
je 0x497d72
mov esi, dword [edi + 0x28]
lea ecx, [ebp - 0x5d4]
push str.Deleting_files
call fcn.00444960
lea eax, [ebp - 0x5d4]
mov byte [ebp - 4], 0x22
push eax
lea eax, [ebp - 0x5e0]
mov ecx, 0x63cf7c
push eax
call fcn.004c42e0
push esi
push dword [eax]
mov byte [ebp - 4], 0x23
push 0
push 3
push dword [ebp - 0x5b4]
call dword [ebp - 0x5a0]
mov edx, dword [ebp - 0x5e0]
add esp, 0x14
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x497d51
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5d4]
mov eax, ebx
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x497d72
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, edi
call fcn.0048fcb0
push str.1461_tKUninstall::RealUninstallFunc_tstart_delete_old_version_product
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x10
cmp dword [edi + 0xdc], 0
je 0x497db2
lea eax, [edi + 0xc4]
push eax
lea ecx, [ebp - 0x580]
call fcn.00429740
jmp 0x497df1
lea eax, [ebp - 0x584]
mov ecx, edi
push eax
call fcn.00496c50
push eax
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], 0x24
call fcn.00429740
mov edx, dword [ebp - 0x584]
mov eax, ebx
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x497df1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov esi, esp
mov dword [ebp - 0x584], esi
mov eax, dword [ebp - 0x580]
add eax, 0xfffffff0
push eax
call fcn.00429b20
add esp, 4
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.0048bb00
cmp byte [0x63d0e4], 0
je 0x497e54
push 0
push 0
push 0x5b5110
push str.StepDeleteFile
push 1
call fcn.004d44f0
add esp, 0x14
cmp byte [0x63d0e4], 0
je 0x497e54
push 0xff
push str.StepDeleteFile
call fcn.004d4550
add esp, 8
push dword [ebp - 0x580]
push str.1472_tKUninstall::RealUninstallFunc_tend_delete_old_version__ws__product
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
push 1
call fcn.0047aef0
add esp, 0x18
lea ecx, [edi + 0x2c]
call fcn.004871e0
push str.office6werhandler.dll
lea eax, [edi + 0x10]
push eax
lea eax, [ebp - 0x58c]
push eax
call fcn.004297b0
push dword [eax]
mov byte [ebp - 4], 0x25
call fcn.00449840
mov edx, dword [ebp - 0x58c]
add esp, 0x10
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x497ec9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x60e478]
mov dword [ebp - 0x58c], eax
mov eax, dword [edi + 0x50]
mov dword [ebp - 0x584], eax
test eax, eax
je 0x497f6c
mov esi, dword [edi + 0x28]
lea ecx, [ebp - 0x590]
push str.Unregistering
call fcn.00444960
lea eax, [ebp - 0x590]
mov byte [ebp - 4], 0x26
push eax
lea eax, [ebp - 0x5a8]
mov ecx, 0x63cf7c
push eax
call fcn.004c42e0
push esi
push dword [eax]
mov byte [ebp - 4], 0x27
push 0
push 4
push dword [ebp - 0x58c]
call dword [ebp - 0x584]
mov edx, dword [ebp - 0x5a8]
add esp, 0x14
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x497f4b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x590]
mov eax, ebx
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x497f6c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [edi + 4], 0
jne 0x4980be
mov ecx, 0x5b6e0c
lea eax, [ebp - 0x18]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x497fa6
test dx, dx
je 0x497fa2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x497fa6
add eax, 4
add ecx, 4
test dx, dx
jne 0x497f80
xor eax, eax
jmp 0x497fab
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4980be
call fcn.00442100
test eax, eax
je 0x497fd4
push 1
push str.WithKsoPost
call fcn.00461020
add esp, 8
cmp eax, 1
jne 0x4980be
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4987a5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x560], eax
mov eax, str._u__GUID___p__PipeName___n_kso__v__InstalledBuildVersion___r_0__i_0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x560]
test eax, 0xffff0000
jne 0x498012
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x49801e
push 0x43
push str._u__GUID___p__PipeName___n_kso__v__InstalledBuildVersion___r_0__i_0
call fcn.0042a000
push dword [ebp - 0x564]
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 0x29
push str._GUID_
call fcn.00463830
lea eax, [ebp - 0x234]
push eax
push str._InstalledBuildVersion_
lea ecx, [ebp - 0x560]
call fcn.00463830
mov eax, dword [ebp - 0x568]
cmp dword [eax - 0xc], 0
jne 0x498073
push 0xe
push str.00001.00000002
lea ecx, [ebp - 0x568]
call fcn.0042a000
mov eax, dword [ebp - 0x568]
push eax
push str._PipeName_
lea ecx, [ebp - 0x560]
call fcn.00463830
mov esi, dword [ebp - 0x560]
push 0
push 1
push 0
push 1
push 0
push esi
push dword [ebp - 0x574]
call fcn.0047f450
add esp, 0x1c
mov byte [ebp - 4], 0x1b
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4980be
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [0x63d0e4], 0
je 0x4980fa
push 0
push 0
push 0x5b5110
push str.StepDeregister
push 1
call fcn.004d44b0
add esp, 0x14
cmp byte [0x63d0e4], 0
je 0x4980fa
push 0xff
push str.StepDeregister
call fcn.004d4530
add esp, 8
xor esi, esi
mov dword [ebp - 0x5a8], esi
push str.1228_tKUninstall::Deregister_tRunApp_Deregister_...
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
mov byte [ebp - 4], 0x2a
call fcn.0046bb20
add esp, 0x10
cmp byte [0x63d0e4], 0
je 0x49815c
push esi
push esi
push 0x5b5110
push str.StepDeregisterUninstall
push 1
call fcn.004d44b0
add esp, 0x14
cmp byte [0x63d0e4], 0
je 0x49815c
push 0xff
push str.StepDeregisterUninstall
call fcn.004d4530
add esp, 8
mov ecx, edi
call fcn.004992c0
cmp byte [0x63d0e4], 0
mov dword [ebp - 0x590], eax
je 0x4981a5
push 0
push 0
push 0x5b5110
push str.StepDeregisterUninstall
push 1
call fcn.004d44f0
add esp, 0x14
cmp byte [0x63d0e4], 0
je 0x4981a5
push 0xff
push str.StepDeregisterUninstall
call fcn.004d4550
add esp, 8
push dword [ebp - 0x590]
push str.1233_tKUninstall::Deregister_tRunApp_Deregister_return:_d
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
cmp dword [ebp - 0x590], 0
mov eax, 1
cmovne esi, eax
push esi
push str.1240_tKUninstall::Deregister_tKInsall::Deregister_return:_d
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x28
mov byte [ebp - 4], 0x1b
cmp byte [0x63d0e4], 0
je 0x498230
push 0
push 0
push 0x5b5110
push str.StepDeregister
push 1
call fcn.004d44f0
add esp, 0x14
cmp byte [0x63d0e4], 0
je 0x498230
push 0xff
push str.StepDeregister
call fcn.004d4550
add esp, 8
call fcn.00442150
mov esi, dword [ebp - 0x5c0]
test eax, eax
je 0x498251
test esi, esi
jne 0x498251
lea eax, [ebp - 0x5c8]
mov ecx, edi
push eax
call fcn.004963e0
cmp byte [0x63d0e4], 0
je 0x49828d
push 0
push 0
push 0x5b5110
push str.StepEndUninstall
push 1
call fcn.004d44b0
add esp, 0x14
cmp byte [0x63d0e4], 0
je 0x49828d
push 0xff
push str.StepEndUninstall
call fcn.004d4530
add esp, 8
mov ecx, edi
call fcn.0048ae40
mov ecx, edi
call fcn.00489d80
mov ecx, edi
call fcn.00489770
push 0
call fcn.004a03c0
push eax
mov ecx, edi
call fcn.00489960
test al, al
jne 0x4982bc
push str.2365_tKUninstall::CleanQmlCache_tclean_Qml_Cache_by_recursion_failed
jmp 0x4982d8
call fcn.004a03c0
push 1
push 0
push dword [eax]
call fcn.0047f220
add esp, 0xc
test eax, eax
jne 0x4982ef
push str.2371_tKUninstall::CleanQmlCache_tremove_empty_folder_failed
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._ERROR_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x10
test esi, esi
je 0x498320
cmp dword [edi + 0x20], 0
jne 0x498320
push str.1518_tKUninstall::RealUninstallFunc_tExecute_remanence_cleanup_program
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x10
lea ecx, [ebp - 0x5f8]
call fcn.004d1f00
mov dword [edi + 8], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x598]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi + 0x4c], eax
mov eax, dword [0x60e47c]
mov dword [ebp - 0x5a8], eax
mov eax, dword [edi + 0x50]
mov dword [ebp - 0x58c], eax
test eax, eax
je 0x49856d
cmp dword [edi + 8], 0
je 0x49856d
mov esi, dword [edi + 0x28]
lea ecx, [ebp - 0x5d0]
push str.Uninstallation_completed
call fcn.00444960
lea eax, [ebp - 0x5d0]
mov byte [ebp - 4], 0x2b
push eax
lea eax, [ebp - 0x5b0]
mov ecx, 0x63cf7c
push eax
call fcn.004c42e0
push esi
push dword [eax]
mov byte [ebp - 4], 0x2c
push 0
push 5
push dword [ebp - 0x5a8]
call dword [ebp - 0x58c]
mov edx, dword [ebp - 0x5b0]
add esp, 0x14
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4983c8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5d0]
mov eax, ebx
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4983e9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [edi + 0xd0]
call fcn.0051ad00
add esp, 4
test eax, eax
jne 0x498567
lea eax, [ebp - 0x5cc]
mov dword [ebp - 0x5b0], 0x104
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push 0x80000002
call dword [ebp - 0x5e4]
test eax, eax
jne 0x49854b
lea eax, [ebp - 0x5b0]
push eax
lea eax, [ebp - 0x43c]
push eax
push 0
push 0
push str.Path
push dword [ebp - 0x5cc]
call dword [ebp - 0x5e8]
test eax, eax
jne 0x49851f
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x5a4]
call fcn.00444a50
push 0xd
push str.iexplore.exe
lea ecx, [ebp - 0x5a4]
mov byte [ebp - 4], 0x2d
call fcn.00429970
push dword [edi + 0xd0]
call fcn.0051bb10
add esp, 4
test eax, eax
je 0x4984e4
push dword [ebp - 0x5a4]
call fcn.0051b990
add esp, 4
test eax, eax
je 0x4984e4
push 1
push 0
push dword [edi + 0xd0]
push dword [ebp - 0x5a4]
push str.open
push 0
call fcn.0051c150
add esp, 0x18
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x5a4]
call fcn.00429660
push dword [ebp - 0x5cc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
jmp 0x49856d
push str.1552_tKUninstall::RealUninstallFunc_tm_strUninstallSurveyUrl_checkUrl_Fail_or_iexplorePath_checkLocalFileSafe_Fail_
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._ERROR_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x10
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x5a4]
call fcn.00429660
push dword [ebp - 0x5cc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
jmp 0x49856d
push str.1557_tKUninstall::RealUninstallFunc_tUnable_to_read_IEXPLORE.EXE_registry_value
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._ERROR_
push 0x63cbb0
call fcn.0046bb20
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x10
push dword [ebp - 0x5cc]
call esi
jmp 0x49856d
push str.1563_tKUninstall::RealUninstallFunc_tUnable_to_open_IEXPLORE.EXE_registry_key_so_unable_to_open_URL_through_iexplore.exe
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._ERROR_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x10
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [edi + 0x48], 0
je 0x4985b6
push str.1570_tKUninstall::RealUninstallFunc_twait_wpsmain
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x10
push 0xffffffffffffffff
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.1572_tKUninstall::RealUninstallFunc_twait_wpsmain_end
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x10
push dword [edi + 0x4c]
push dword [edi + 8]
push str.1575_tKUninstall::RealUninstallFunc_tuninstall_end__return:_d__install_cost_time:_dms
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x18
cmp byte [0x63d0e4], 0
je 0x498614
push 0
push 0
push 0x5b5110
push str.StepEndUninstall
push 1
call fcn.004d44f0
add esp, 0x14
cmp byte [0x63d0e4], 0
je 0x498614
push 0xff
push str.StepEndUninstall
call fcn.004d4550
add esp, 8
mov edx, dword [ebp - 0x570]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x498631
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x564]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49864e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x55c]
call fcn.004885c0
mov eax, dword [ebp - 0x594]
test eax, eax
je 0x498666
push eax
call esi
mov edx, dword [ebp - 0x568]
mov eax, ebx
mov dword [ebp - 0x594], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49868d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x5f8]
call fcn.004d1d40
mov edx, dword [ebp - 0x5c8]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4986b5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x574]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4986d2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x578]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4986ef
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x57c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49870c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x56c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x498729
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x580]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x498746
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5c4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x498761
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00557e89
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00429b00
push 0x80004005
call fcn.00429b00
push 0x80070057
call fcn.00429b00
call fcn.00566a14
call fcn.00566a14
push 0x80004005
call fcn.00429b00
int3