Function at 0x44fd2e
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Create process on windows
Read .ini file
Self delete

Disassembly:
push 0x348
mov eax, 0x4885fb
call fcn.00468ad7
mov esi, ecx
mov ebx, 0x4c1160
push ebx
lea ecx, [ebp - 0x354]
call fcn.004237f4
and dword [ebp - 4], 0
push ebx
lea ecx, [ebp - 0x330]
call fcn.004237f4
push ebx
lea ecx, [ebp - 0x32c]
mov byte [ebp - 4], 1
call fcn.004237f4
xor eax, eax
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
push ebx
lea ecx, [ebp - 0x344]
mov byte [ebp - 4], 2
stosd dword es:[edi], eax
call fcn.004237f4
xor eax, eax
push 0x206
mov word [ebp - 0x220], ax
xor edi, edi
lea eax, [ebp - 0x21e]
push edi
push eax
mov byte [ebp - 4], 3
call fcn.00466c70
add esp, 0xc
push ebx
lea ecx, [ebp - 0x348]
call fcn.004237f4
push ebx
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 4
call fcn.004237f4
push ebx
lea ecx, [ebp - 0x334]
mov byte [ebp - 4], 5
call fcn.004237f4
mov dword [ebp - 0x33c], edi
push 1
push dword [0x4be7a0]
lea ecx, [ebp - 0x33c]
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 7
call fcn.00424ae3
test eax, eax
je 0x44fe17
lea eax, [ebp - 0x334]
push eax
push str.DistSrc
lea ecx, [ebp - 0x33c]
call fcn.004256d8
lea ecx, [ebp - 0x31c]
call fcn.00457be7
push 0x499554
lea ecx, [ebp - 0x34c]
mov byte [ebp - 4], 8
call fcn.00418067
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], 9
call fcn.0045825b
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0xa
jb 0x44fe58
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x34c]
call fcn.00417f66
push edi
push 1
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 9
call fcn.0041f501
mov ebx, 0x499550
push ebx
call fcn.00468f76
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x34c]
call fcn.00417d0b
mov eax, dword [0x4be840]
mov dword [ebp - 0x328], eax
mov ebx, 0x4c2248
cmp dword [esi + 0x48], edi
je 0x44ff05
push str.Preparing_to_uninstall
lea ecx, [ebp - 0x320]
call fcn.0042bda8
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x324]
push eax
mov ecx, ebx
mov byte [ebp - 4], 0xb
call fcn.00459187
push dword [esi + 0x20]
mov eax, dword [eax]
push eax
push edi
push edi
push dword [ebp - 0x328]
mov byte [ebp - 4], 0xc
call dword [esi + 0x48]
mov ecx, dword [ebp - 0x324]
add esp, 0x14
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x320]
add ecx, 0xfffffff0
mov byte [ebp - 4], 9
call fcn.00417891
call fcn.004453e8
mov ecx, esi
cmp dword [esi + 0xc4], edi
je 0x44ff44
lea eax, [ebp - 0x324]
push eax
call fcn.0044a68c
lea ecx, [esi + 0xb4]
push eax
mov byte [ebp - 4], 0xd
call fcn.00417f16
mov ecx, dword [ebp - 0x324]
add ecx, 0xfffffff0
mov byte [ebp - 4], 9
call fcn.00417891
jmp 0x44ff49
call fcn.0044bdc7
mov eax, dword [esi + 0xc]
sub eax, 0x10
push eax
call fcn.00417b88
add eax, 0x10
mov dword [ebp - 0x338], eax
lea eax, [ebp - 0x338]
push eax
mov byte [ebp - 4], 0xe
call fcn.004461ac
mov edi, str.utilityinstall.ini
push edi
call fcn.00468f76
add esp, 0xc
push eax
push edi
lea ecx, [ebp - 0x338]
call fcn.00417d0b
push dword [ebp - 0x338]
xor eax, eax
mov word [ebp - 0x234], ax
lea edi, [ebp - 0x232]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa
stosw word es:[edi], ax
lea eax, [ebp - 0x234]
push eax
push str.false
push str.InstallPerUser
mov edi, str.update
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x234]
push str.true
push eax
call fcn.00468eeb
pop ecx
pop ecx
push dword [ebp - 0x338]
neg eax
push str.false
sbb eax, eax
push str.needAdmin
inc eax
push edi
mov dword [esi + 0xc8], eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [esi + 0xc]
lea ecx, [ebp - 0x354]
mov dword [ebp - 0x350], eax
call fcn.004451a4
xor edi, edi
cmp eax, edi
je 0x4505ad
push str.uninstall_begin...
push 0x4c1dc0
mov dword [esi + 4], edi
call fcn.00448b55
mov eax, dword [str._FPcd]
pop ecx
pop ecx
mov dword [ebp - 0x328], eax
cmp dword [esi + 0x48], edi
je 0x4500a2
push str.Performing_the_preparation_before_uninstallation
lea ecx, [ebp - 0x320]
call fcn.0042bda8
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x324]
push eax
mov ecx, ebx
mov byte [ebp - 4], 0xf
call fcn.00459187
push dword [esi + 0x20]
mov eax, dword [eax]
push eax
push edi
push 1
push dword [ebp - 0x328]
mov byte [ebp - 4], 0x10
call dword [esi + 0x48]
mov ecx, dword [ebp - 0x324]
add esp, 0x14
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x320]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xe
call fcn.00417891
mov ecx, esi
call fcn.0044ed2b
cmp eax, edi
jne 0x450115
cmp dword [esi + 0x48], edi
je 0x450115
push str.Failed_to_perform_the_preparation_before_uninstallation
lea ecx, [ebp - 0x320]
call fcn.0042bda8
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x324]
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x11
call fcn.00459187
push dword [esi + 0x20]
mov eax, dword [eax]
push eax
push 2
push 1
push dword [ebp - 0x328]
mov byte [ebp - 4], 0x12
call dword [esi + 0x48]
mov ecx, dword [ebp - 0x324]
add esp, 0x14
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x320]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xe
call fcn.00417891
mov eax, dword [0x4be848]
mov dword [ebp - 0x328], eax
cmp dword [esi + 0x48], edi
je 0x450187
push str.Deleting_files
lea ecx, [ebp - 0x320]
call fcn.0042bda8
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x324]
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x13
call fcn.00459187
push dword [esi + 0x20]
mov eax, dword [eax]
push eax
push edi
push 2
push dword [ebp - 0x328]
mov byte [ebp - 4], 0x14
call dword [esi + 0x48]
mov ecx, dword [ebp - 0x324]
add esp, 0x14
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x320]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xe
call fcn.00417891
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x32c]
call fcn.00417f16
lea eax, [ebp - 0x32c]
push eax
call fcn.004461ac
mov dword [esp], str.office6KsoPost.exe
call fcn.00468f76
pop ecx
push eax
push str.office6KsoPost.exe
lea ecx, [ebp - 0x32c]
call fcn.00417d0b
lea eax, [ebp - 0x340]
push eax
mov ecx, esi
call fcn.0044b0ad
push str.KsoPost.exe
call fcn.00468f76
pop ecx
push eax
push str.KsoPost.exe
lea ecx, [ebp - 0x340]
call fcn.00417d0b
push dword [ebp - 0x32c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45020d
push edi
push dword [ebp - 0x340]
push dword [ebp - 0x32c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x344]
call fcn.00417f16
lea eax, [ebp - 0x344]
push eax
call fcn.004461ac
mov dword [esp], str.utilityinstall.ini
call fcn.00468f76
pop ecx
push eax
push str.utilityinstall.ini
lea ecx, [ebp - 0x344]
call fcn.00417d0b
push dword [ebp - 0x344]
lea eax, [ebp - 0x18]
push 3
push eax
push 0x48c678
push str.withKsoPost
push str.installinfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x348]
call fcn.00417f16
lea eax, [ebp - 0x348]
push eax
call fcn.004461ac
mov dword [esp], str.office6cfgs_setup.cfg
call fcn.00468f76
pop ecx
push eax
push str.office6cfgs_setup.cfg
lea ecx, [ebp - 0x348]
call fcn.00417d0b
push dword [ebp - 0x348]
lea eax, [ebp - 0x220]
push 0x104
push eax
push 0x48c308
push str.Version
push str.version
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push edi
call fcn.004454e2
pop ecx
mov ecx, esi
call fcn.0044cf31
mov ecx, esi
call fcn.0044d1ec
mov eax, dword [0x4be84c]
mov dword [ebp - 0x328], eax
cmp dword [esi + 0x48], edi
je 0x45034e
push str.Deleting_files
lea ecx, [ebp - 0x320]
call fcn.0042bda8
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x324]
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x15
call fcn.00459187
push dword [esi + 0x20]
mov eax, dword [eax]
push eax
push edi
push 3
push dword [ebp - 0x328]
mov byte [ebp - 4], 0x16
call dword [esi + 0x48]
mov ecx, dword [ebp - 0x324]
add esp, 0x14
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x320]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xe
call fcn.00417891
mov ecx, esi
call fcn.0044ba60
push str.start_delete_old_version_product
push 0x4c1dc0
call fcn.00448b55
pop ecx
pop ecx
cmp dword [esi + 0xc4], edi
je 0x450382
lea eax, [esi + 0xb4]
push eax
lea ecx, [ebp - 0x330]
call fcn.00417f16
jmp 0x4503b2
lea eax, [ebp - 0x324]
push eax
mov ecx, esi
call fcn.0044b3b3
push eax
lea ecx, [ebp - 0x330]
mov byte [ebp - 4], 0x17
call fcn.00417f16
mov ecx, dword [ebp - 0x324]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xe
call fcn.00417891
mov eax, dword [ebp - 0x330]
push ecx
mov dword [ebp - 0x324], esp
add eax, 0xfffffff0
mov dword [ebp - 0x324], esp
push eax
call fcn.00417b88
pop ecx
mov ecx, dword [ebp - 0x324]
add eax, 0x10
mov dword [ecx], eax
mov ecx, esi
call fcn.0044bfbc
push dword [ebp - 0x330]
push str.end_delete_old_version__ws__product
push 0x4c1dc0
call fcn.00448b55
push 1
call fcn.004454e2
add esp, 0x10
lea ecx, [esi + 0x24]
call fcn.0044818a
push str.office6werhandler.dll
lea eax, [esi + 0xc]
push eax
lea eax, [ebp - 0x324]
push eax
call fcn.00417e8f
push dword [eax]
mov byte [ebp - 4], 0x18
call fcn.0042b5f4
mov ecx, dword [ebp - 0x324]
add esp, 0x10
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xe
call fcn.00417891
mov eax, dword [0x4be850]
mov dword [ebp - 0x328], eax
cmp dword [esi + 0x48], edi
je 0x4504af
push str.Unregistering
lea ecx, [ebp - 0x320]
call fcn.0042bda8
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x324]
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x19
call fcn.00459187
push dword [esi + 0x20]
mov eax, dword [eax]
push eax
push edi
push 4
push dword [ebp - 0x328]
mov byte [ebp - 4], 0x1a
call dword [esi + 0x48]
mov ecx, dword [ebp - 0x324]
add esp, 0x14
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x320]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xe
call fcn.00417891
cmp dword [esi], edi
jne 0x450598
lea eax, [ebp - 0x18]
push 0x48f54c
push eax
call fcn.00468cab
pop ecx
pop ecx
test eax, eax
jne 0x450598
call fcn.00429718
test eax, eax
je 0x4504ef
push 1
push str.WithKsoPost
call fcn.0043c6c4
pop ecx
pop ecx
cmp eax, 1
jne 0x450598
push str._u__GUID___p__PipeName___n_kso__v__InstalledBuildVersion___i_0
lea ecx, [ebp - 0x328]
call fcn.00418067
push dword [ebp - 0x34c]
lea ecx, [ebp - 0x328]
push str._GUID_
mov byte [ebp - 4], 0x1b
call fcn.0043ce0e
lea eax, [ebp - 0x220]
push eax
push str._InstalledBuildVersion_
lea ecx, [ebp - 0x328]
call fcn.0043ce0e
mov eax, dword [ebp - 0x334]
cmp dword [eax - 0xc], edi
jne 0x450557
push str.00001.00000002
call fcn.00468f76
pop ecx
push eax
push str.00001.00000002
lea ecx, [ebp - 0x334]
call fcn.00417d8b
push dword [ebp - 0x334]
lea ecx, [ebp - 0x328]
push str._PipeName_
call fcn.0043ce0e
push 1
push 1
push edi
push dword [ebp - 0x328]
push dword [ebp - 0x340]
call fcn.004452b2
mov ecx, dword [ebp - 0x328]
add esp, 0x14
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xe
call fcn.00417891
mov ecx, esi
call fcn.0044ea73
mov ecx, esi
call fcn.0044c09b
mov dword [esi + 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x350]
mov dword [esi + 0x44], eax
mov eax, dword [0x4be854]
mov dword [ebp - 0x328], eax
cmp dword [esi + 0x48], edi
je 0x450674
cmp dword [esi + 4], edi
je 0x450674
push str.Uninstallation_completed
lea ecx, [ebp - 0x320]
call fcn.0042bda8
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x350]
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x1c
call fcn.00459187
push dword [esi + 0x20]
mov eax, dword [eax]
push eax
push edi
push 5
push dword [ebp - 0x328]
mov byte [ebp - 4], 0x1d
call dword [esi + 0x48]
mov ecx, dword [ebp - 0x350]
add esp, 0x14
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x320]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xe
call fcn.00417891
mov eax, dword [esi + 0xc0]
cmp dword [eax - 0xc], edi
je 0x450674
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push edi
push edi
push eax
push str.open
push edi
call ebx
cmp eax, 0x20
jg 0x450674
push 1
push edi
push dword [esi + 0xc0]
push str.iexplore
push str.open
push edi
call ebx
mov ebx, 0x4c1dc0
cmp dword [esi + 0x40], edi
je 0x4506a3
push str.wait_wpsmain
push ebx
call fcn.00448b55
pop ecx
pop ecx
push 0xffffffffffffffff
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.wait_wpsmain_end
push ebx
call fcn.00448b55
pop ecx
pop ecx
push dword [esi + 0x44]
push dword [esi + 4]
push str.uninstall_end__return:_d__install_cost_time:_dms
push ebx
call fcn.00448b55
mov ecx, dword [ebp - 0x338]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x34c]
add ecx, 0xfffffff0
call fcn.00417891
lea ecx, [ebp - 0x31c]
call fcn.00449656
cmp dword [ebp - 0x33c], edi
je 0x4506f2
push dword [ebp - 0x33c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x334]
add ecx, 0xfffffff0
mov dword [ebp - 0x33c], edi
call fcn.00417891
mov ecx, dword [ebp - 0x340]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x348]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x344]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x32c]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x330]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x354]
add ecx, 0xfffffff0
call fcn.00417891
call fcn.00468b5a
ret