Function at 0x433fe0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x596650
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x61ce74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
call fcn.00435320
add esp, 4
mov ebx, eax
cmp dword [ebp + 0xc], 0
je 0x4340a1
cmp dword [ebp + 0x10], 0
jne 0x43403a
xor eax, eax
and eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0xc]
push eax
call fcn.0043c160
add esp, 4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0
mov ecx, dword [eax - 0xc]
lea esi, [ecx*2 + 2]
mov dword [ebp - 0x18], esi
test esi, esi
js 0x43426b
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, esi
or ecx, edx
jge 0x434085
push esi
lea ecx, [ebp + 0xc]
call fcn.00426250
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x4a
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp + 0xc]
jmp 0x434238
add esi, 0xffffff9b
xor eax, eax
cmp esi, 3
ja case.default.0x4340af
jmp dword [esi*4 + 0x434278]
cmp dword [0x61b448], eax
jne 0x434253
push 0x80000001
call fcn.00435c10
push 0x80000001
call fcn.00436770
add esp, 8
jmp 0x434253
push 0x80000001
call fcn.004363c0
push 0x5b3ec4
push 0x5b3ec8
push dword [0x61b418]
push 0x80000001
call fcn.0045c310
add esp, 0x14
call fcn.004356e0
mov eax, dword [0x629a0c]
mov ecx, str.th_TH
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43413a
test dx, dx
je 0x434136
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43413a
add eax, 4
add ecx, 4
test dx, dx
jne 0x434114
xor eax, eax
jmp 0x43413f
sbb eax, eax
or eax, 1
test eax, eax
jne 0x434253
cmp dword [0x6299b0], eax
je 0x434253
push str.Tahoma
push str.FontFace
push dword [0x61b43c]
push 0x80000001
call fcn.0045c310
push 0xde
push str.FontCharSet
push dword [0x61b43c]
push 0x80000001
call fcn.0045c240
add esp, 0x20
jmp 0x434253
cmp dword [0x61b44c], eax
jne 0x43419c
call fcn.00438840
call fcn.00437a00
call fcn.00438330
push str.wpslive
push dword [0x61b3e0]
push 0x80000001
call fcn.0045bde0
push str.wpslive
push dword [0x61b430]
push 0x80000001
call fcn.0045bed0
push 0x80000001
call fcn.00438790
push 0x80000001
call fcn.004385f0
add esp, 0x20
jmp 0x434253
push str.office6_addonsqingqingbangong.dll
push dword [0x6299c4]
lea eax, [ebp - 0x10]
push eax
call fcn.004430a0
add esp, 0xc
cmp dword [0x61b448], 0
mov dword [ebp - 4], 1
jne 0x434235
push dword [ebp - 0x10]
push str.LibPath
push dword [0x61b42c]
push 0x80000001
call fcn.0045c310
push 0x80000001
call fcn.004362a0
add esp, 0x14
mov edx, dword [ebp - 0x10]
or eax, 0xffffffff
add edx, 0xfffffff0
mov dword [ebp - 4], eax
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x434253
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
and eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00425f50
lea ecx, [ecx]
mov dh, 0x40
inc ebx
add dh, bl
inc eax
inc ebx
add byte [edi - 0x16ffbcbf], cl
inc ecx
inc ebx
add ah, cl
int3