Function at 0x45e51b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor esi, esi
push eax
push str.SOFTWAREKingsoftAntivirus
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov eax, dword [ebp - 4]
jne 0x45e638
mov dword [ebp - 8], esi
test eax, eax
je 0x45e5bc
lea ecx, [ebp - 8]
push ecx
push esi
lea ecx, [ebp - 0xc]
push ecx
push esi
push str.ProductID
push eax
call edi
cmp dword [ebp - 0xc], 1
jne 0x45e5b9
lea ecx, [ebx + 0x30]
call fcn.004041c0
mov eax, dword [ebp - 8]
lea ecx, [ebx + 0x30]
shr eax, 1
inc eax
push eax
call fcn.004047c0
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], eax
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str.ProductID
push dword [ebp - 4]
call edi
test eax, eax
jne 0x45e5b9
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 0x10]
shr eax, 1
push 0xffffffffffffffff
mov word [ecx + eax*2], dx
lea ecx, [ebx + 0x30]
call fcn.0040e311
mov eax, dword [ebp - 4]
mov dword [ebp - 8], esi
test eax, eax
je 0x45e633
lea ecx, [ebp - 8]
push ecx
push esi
lea ecx, [ebp - 0xc]
push ecx
push esi
push str.versiontypes
push eax
call edi
cmp dword [ebp - 0xc], 1
jne 0x45e625
lea ecx, [ebx + 0x2c]
call fcn.004041c0
mov eax, dword [ebp - 8]
lea ecx, [ebx + 0x2c]
shr eax, 1
inc eax
push eax
call fcn.004047c0
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], eax
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str.versiontypes
push dword [ebp - 4]
call edi
test eax, eax
jne 0x45e625
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 0x10]
shr eax, 1
push 0xffffffffffffffff
mov word [ecx + eax*2], dx
lea ecx, [ebx + 0x2c]
call fcn.0040e311
cmp dword [ebp - 4], esi
je 0x45e633
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov dword [ebp - 4], eax
test eax, eax
je 0x45e643
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push str.SOFTWAREKingsoftAntivirusSetup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x45e892
mov eax, dword [ebp - 4]
mov dword [ebp - 8], esi
test eax, eax
je 0x45e6d1
lea ecx, [ebp - 8]
push ecx
push esi
lea ecx, [ebp - 0xc]
push ecx
push esi
push 0x61684c
push eax
call edi
cmp dword [ebp - 0xc], 1
jne 0x45e6ce
lea ecx, [ebx + 0x18]
call fcn.004041c0
mov eax, dword [ebp - 8]
lea ecx, [ebx + 0x18]
shr eax, 1
inc eax
push eax
call fcn.004047c0
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], eax
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0x61684c
push dword [ebp - 4]
call edi
test eax, eax
jne 0x45e6ce
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 0x10]
shr eax, 1
push 0xffffffffffffffff
mov word [ecx + eax*2], dx
lea ecx, [ebx + 0x18]
call fcn.0040e311
mov eax, dword [ebp - 4]
mov dword [ebp - 8], esi
test eax, eax
je 0x45e73d
lea ecx, [ebp - 8]
push ecx
push esi
lea ecx, [ebp - 0xc]
push ecx
push esi
push str.tod1
push eax
call edi
cmp dword [ebp - 0xc], 1
jne 0x45e73a
lea ecx, [ebx + 0x1c]
call fcn.004041c0
mov eax, dword [ebp - 8]
lea ecx, [ebx + 0x1c]
shr eax, 1
inc eax
push eax
call fcn.004047c0
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], eax
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str.tod1
push dword [ebp - 4]
call edi
test eax, eax
jne 0x45e73a
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 0x10]
shr eax, 1
push 0xffffffffffffffff
mov word [ecx + eax*2], dx
lea ecx, [ebx + 0x1c]
call fcn.0040e311
mov eax, dword [ebp - 4]
mov dword [ebp - 8], esi
test eax, eax
je 0x45e7a9
lea ecx, [ebp - 8]
push ecx
push esi
lea ecx, [ebp - 0xc]
push ecx
push esi
push str.tod2
push eax
call edi
cmp dword [ebp - 0xc], 1
jne 0x45e7a6
lea ecx, [ebx + 0x20]
call fcn.004041c0
mov eax, dword [ebp - 8]
lea ecx, [ebx + 0x20]
shr eax, 1
inc eax
push eax
call fcn.004047c0
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], eax
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str.tod2
push dword [ebp - 4]
call edi
test eax, eax
jne 0x45e7a6
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 0x10]
shr eax, 1
push 0xffffffffffffffff
mov word [ecx + eax*2], dx
lea ecx, [ebx + 0x20]
call fcn.0040e311
mov eax, dword [ebp - 4]
mov dword [ebp - 8], esi
test eax, eax
je 0x45e815
lea ecx, [ebp - 8]
push ecx
push esi
lea ecx, [ebp - 0xc]
push ecx
push esi
push str.tid1
push eax
call edi
cmp dword [ebp - 0xc], 1
jne 0x45e812
lea ecx, [ebx + 0x24]
call fcn.004041c0
mov eax, dword [ebp - 8]
lea ecx, [ebx + 0x24]
shr eax, 1
inc eax
push eax
call fcn.004047c0
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], eax
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str.tid1
push dword [ebp - 4]
call edi
test eax, eax
jne 0x45e812
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 0x10]
shr eax, 1
push 0xffffffffffffffff
mov word [ecx + eax*2], dx
lea ecx, [ebx + 0x24]
call fcn.0040e311
mov eax, dword [ebp - 4]
mov dword [ebp - 8], esi
test eax, eax
je 0x45e88c
lea ecx, [ebp - 8]
push ecx
push esi
lea ecx, [ebp - 0xc]
push ecx
push esi
push str.tid2
push eax
call edi
cmp dword [ebp - 0xc], 1
jne 0x45e87e
lea ecx, [ebx + 0x28]
call fcn.004041c0
mov eax, dword [ebp - 8]
lea ecx, [ebx + 0x28]
shr eax, 1
inc eax
push eax
call fcn.004047c0
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], eax
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str.tid2
push dword [ebp - 4]
call edi
test eax, eax
jne 0x45e87e
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 0x10]
shr eax, 1
push 0xffffffffffffffff
mov word [ecx + eax*2], dx
lea ecx, [ebx + 0x28]
call fcn.0040e311
cmp dword [ebp - 4], esi
je 0x45e88c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], esi
xor esi, esi
inc esi
mov ecx, ebx
call fcn.0045e93e
cmp dword [ebp - 4], 0
je 0x45e8a8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret