Function at 0x49ddf0
Capabilities:
Delete registry value
Link many functions at runtime
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e4f8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x61ce74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
lea eax, [ebp - 0x24]
mov dword [ebp - 4], ebx
push eax
push 0x2001f
push ebx
push 0x5b0144
push 0x80000000
mov dword [ebp - 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x49df04
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x30]
push str..uof
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ebx
call fcn.004349b0
push str..uop
lea ecx, [ebp - 0x30]
call fcn.004349b0
push str..uos
lea ecx, [ebp - 0x30]
call fcn.004349b0
push str..uot
lea ecx, [ebp - 0x30]
call fcn.004349b0
push str.ksotheme
lea ecx, [ebp - 0x30]
call fcn.004349b0
push str.WPSSkin.WPSSkinAddin
lea ecx, [ebp - 0x30]
call fcn.004349b0
push 0x5b3f9c
lea ecx, [ebp - 0x30]
call fcn.004349b0
push str.Wps_auto_file
lea ecx, [ebp - 0x30]
call fcn.004349b0
push str.Wpsdoc.wpsdoc
lea ecx, [ebp - 0x30]
call fcn.004349b0
push str.Et_auto_file
lea ecx, [ebp - 0x30]
call fcn.004349b0
push str.Uof_auto_file
lea ecx, [ebp - 0x30]
call fcn.004349b0
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x49defa
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x14], 0
test ebx, ebx
je 0x49df64
cmp dword [ebx], 0
je 0x49df57
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x49df2a
mov eax, 1
jmp 0x49df80
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49df5d
push 0
push dword [ebx]
lea ecx, [ebp - 0x14]
push ecx
push 0x2001f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000001
call eax
jmp 0x49df80
cmp dword [ebx + 4], 0
jne 0x49df64
mov eax, 1
jmp 0x49df80
lea eax, [ebp - 0x14]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x2001f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000001
call eax
test eax, eax
jne 0x49dfc2
test edi, edi
je 0x49df8b
push edi
call esi
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x49dfc2
push 0x5b4034
lea ecx, [ebp - 0x30]
call fcn.004349b0
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x49dfb8
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
xor esi, esi
mov dword [ebp - 0x10], esi
test ebx, ebx
je 0x49e026
cmp dword [ebx], esi
je 0x49e01a
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x49dfe3
lea eax, [esi + 1]
jmp 0x49e041
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49e010
push 0
push dword [ebx]
lea ecx, [ebp - 0x10]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0Common
push 0x80000001
call eax
jmp 0x49e041
mov esi, dword [ebp - 0x10]
mov eax, 1
jmp 0x49e044
cmp dword [ebx + 4], esi
jne 0x49e026
mov eax, 1
jmp 0x49e044
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0Common
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x49e0fb
test edi, edi
je 0x49e05a
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x2c], 0
mov edi, esi
mov dword [ebp - 0x30], edi
test eax, eax
jne 0x49e0fb
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.Version
push esi
call ebx
push str.PersonalVersionNumber
push esi
call ebx
push str.ProfessionVersionNumber
push esi
call ebx
push str.InstallRoot
push esi
call ebx
push str.DisplayName
push esi
call ebx
push str.DistSrc
push esi
call ebx
push str.DefaultLanguage
push esi
call ebx
push str.hostprocname
push esi
call ebx
push str.category
push esi
call ebx
push str.newGuideShow
push esi
call ebx
push str.Theme
lea ecx, [ebp - 0x30]
call fcn.004349b0
push str.plgpf
lea ecx, [ebp - 0x30]
call fcn.004349b0
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x49e0f1
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x18], 0
test ebx, ebx
je 0x49e15b
cmp dword [ebx], 0
je 0x49e14e
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x49e121
mov eax, 1
jmp 0x49e176
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49e154
push 0
push dword [ebx]
lea ecx, [ebp - 0x18]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
push 0x80000001
call eax
jmp 0x49e176
cmp dword [ebx + 4], 0
jne 0x49e15b
mov eax, 1
jmp 0x49e176
lea eax, [ebp - 0x18]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49e1b7
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x49e187
push edi
call esi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x49e1b7
push str.qald
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x49e1b0
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
test ebx, ebx
je 0x49e217
cmp dword [ebx], 0
je 0x49e20a
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x49e1dd
mov eax, 1
jmp 0x49e232
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49e210
push 0
push dword [ebx]
lea ecx, [ebp - 0x1c]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0Commonupdateinfo
push 0x80000001
call eax
jmp 0x49e232
cmp dword [ebx + 4], 0
jne 0x49e217
mov eax, 1
jmp 0x49e232
lea eax, [ebp - 0x1c]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0Commonupdateinfo
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49e27a
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x49e243
push edi
call esi
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x49e27a
push str.cacheStatusInfo
lea ecx, [ebp - 0x30]
call fcn.004349b0
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x49e270
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov esi, dword [str.SoftwarekingsoftOffice6.0Commonupdateinfo]
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x49e2dc
cmp dword [ebx], 0
je 0x49e2cf
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x49e2a6
mov eax, 1
jmp 0x49e2f3
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49e2d5
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push esi
push 0x80000001
call eax
jmp 0x49e2f3
cmp dword [ebx + 4], 0
jne 0x49e2dc
mov eax, 1
jmp 0x49e2f3
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49e334
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x49e304
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x49e334
push str.diffcheckerror
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x49e32d
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x49e394
cmp dword [ebx], 0
je 0x49e387
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x49e35a
mov eax, 1
jmp 0x49e3af
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49e38d
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0etApplication_Settings
push 0x80000001
call eax
jmp 0x49e3af
cmp dword [ebx + 4], 0
jne 0x49e394
mov eax, 1
jmp 0x49e3af
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0etApplication_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49e3f0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x49e3c0
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x49e3f0
push str.RestartAppInfo
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x49e3e9
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x49e450
cmp dword [ebx], 0
je 0x49e443
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x49e416
mov eax, 1
jmp 0x49e46b
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49e449
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wpsApplication_Settings
push 0x80000001
call eax
jmp 0x49e46b
cmp dword [ebx + 4], 0
jne 0x49e450
mov eax, 1
jmp 0x49e46b
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wpsApplication_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49e4ac
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x49e47c
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x49e4ac
push str.RestartAppInfo
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x49e4a5
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x49e50c
cmp dword [ebx], 0
je 0x49e4ff
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x49e4d2
mov eax, 1
jmp 0x49e527
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49e505
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wppApplication_Settings
push 0x80000001
call eax
jmp 0x49e527
cmp dword [ebx + 4], 0
jne 0x49e50c
mov eax, 1
jmp 0x49e527
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wppApplication_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49e568
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x49e538
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x49e568
push str.RestartAppInfo
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x49e561
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x49e5c8
cmp dword [ebx], 0
je 0x49e5bb
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x49e58e
mov eax, 1
jmp 0x49e5e3
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49e5c1
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wpsofficeApplication_Settings
push 0x80000001
call eax
jmp 0x49e5e3
cmp dword [ebx + 4], 0
jne 0x49e5c8
mov eax, 1
jmp 0x49e5e3
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wpsofficeApplication_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49e624
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x49e5f4
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x49e624
push str.AppComponentMode
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x49e61d
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x49e684
cmp dword [ebx], 0
je 0x49e677
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x49e64a
mov eax, 1
jmp 0x49e69f
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49e67d
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0pluginskstartpage
push 0x80000001
call eax
jmp 0x49e69f
cmp dword [ebx + 4], 0
jne 0x49e684
mov eax, 1
jmp 0x49e69f
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0pluginskstartpage
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49e6f4
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x49e6b0
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x49e6f4
push str.searchRecord
lea ecx, [ebp - 0x30]
call fcn.004349b0
push str.searchRecord2
lea ecx, [ebp - 0x30]
call fcn.004349b0
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x49e6ea
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x10], 0
test ebx, ebx
je 0x49e754
cmp dword [ebx], 0
je 0x49e747
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x49e71a
mov eax, 1
jmp 0x49e76f
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49e74d
push 0
push dword [ebx]
lea ecx, [ebp - 0x10]
push ecx
push 0x2001f
push 0
push str.Environment
push 0x80000001
call eax
jmp 0x49e76f
cmp dword [ebx + 4], 0
jne 0x49e754
mov eax, 1
jmp 0x49e76f
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
push str.Environment
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49e950
test edi, edi
je 0x49e782
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x49e950
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f587
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
push str.WPS_HOME
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x208
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push str.PATH
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49e91a
mov eax, dword [ebp - 0x20]
cmp eax, 1
je 0x49e7f9
cmp eax, 2
jne 0x49e91a
mov eax, dword [ebp - 0x24]
shr eax, 1
mov dword [ebp - 0x24], eax
je 0x49e91a
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0053d0bd
mov ecx, dword [ebp - 0x24]
add esp, 4
mov esi, eax
add ecx, ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ecx
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push 0
push str.PATH
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49e866
mov eax, dword [ebp - 0x20]
cmp eax, 1
je 0x49e857
cmp eax, 2
jne 0x49e866
test esi, esi
je 0x49e86a
cmp dword [ebp - 0x24], 0
jne 0x49e866
xor eax, eax
mov word [esi], ax
test esi, esi
jne 0x49e86e
xor ecx, ecx
jmp 0x49e882
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49e873
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x14]
call fcn.00425dc0
push esi
call fcn.0053d0c6
add esp, 4
lea ecx, [ebp - 0x14]
push 0x5b0144
push str._WPS_HOME__
call fcn.0045b810
push 0x5b0144
push str.__WPS_HOME_
lea ecx, [ebp - 0x14]
call fcn.0045b810
push 0x5b0144
push str._WPS_HOME_
lea ecx, [ebp - 0x14]
call fcn.0045b810
mov esi, dword [ebp - 0x14]
cmp dword [esi - 0xc], 0
je 0x49e90c
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49e8e0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 2
push 0
push str.PATH
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x49e91a
push str.PATH
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x49e92d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x49e950
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp + 8], 0
jne 0x49f56a
lea ecx, [ebp - 0x3c]
call fcn.004baa40
push 0x104
push ecx
mov esi, esp
mov byte [ebp - 4], 2
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f587
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.infoGUID
mov byte [ebp - 4], 3
mov ecx, esi
test eax, 0xffff0000
jne 0x49e9aa
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49e9b6
push 8
push str.infoGUID
call fcn.004263f0
push ecx
mov esi, esp
mov byte [ebp - 4], 4
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f591
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0Common
mov byte [ebp - 4], 5
shr eax, 0x10
mov ecx, str.SoftwareKingsoftOffice6.0Common
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x49e9fe
movzx eax, cx
mov ecx, esi
push eax
call fcn.00426130
jmp 0x49ea0c
push 0x23
push str.SoftwareKingsoftOffice6.0Common
mov ecx, esi
call fcn.004263f0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004badd0
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f587
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.savedump
mov byte [ebp - 4], 6
mov ecx, esi
test eax, 0xffff0000
jne 0x49ea65
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49ea71
push 8
push str.savedump
call fcn.004263f0
push ecx
mov esi, esp
mov byte [ebp - 4], 7
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f59b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 8
jne 0x49eab0
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49eabc
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.004263f0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004badd0
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f587
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.fulldump
mov byte [ebp - 4], 9
mov ecx, esi
test eax, 0xffff0000
jne 0x49eb15
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49eb21
push 8
push str.fulldump
call fcn.004263f0
push ecx
mov esi, esp
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f5a5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0xb
jne 0x49eb60
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49eb6c
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.004263f0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004badd0
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f587
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.wpsiu
mov byte [ebp - 4], 0xc
mov ecx, esi
test eax, 0xffff0000
jne 0x49ebc5
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49ebd1
push 5
push str.wpsiu
call fcn.004263f0
push ecx
mov esi, esp
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f5af
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0xe
jne 0x49ec10
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49ec1c
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.004263f0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004badd0
push 0x800
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f587
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.Pushed
mov byte [ebp - 4], 0xf
mov ecx, esi
test eax, 0xffff0000
jne 0x49ec75
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49ec81
push 6
push str.Pushed
call fcn.004263f0
push ecx
mov esi, esp
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f5b9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0x11
jne 0x49ecc0
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49eccc
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.004263f0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004badd0
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x24], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f587
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, 0x5b4380
mov byte [ebp - 4], 0x12
mov ecx, esi
test eax, 0xffff0000
jne 0x49ed25
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49ed31
push 3
push 0x5b4380
call fcn.004263f0
push ecx
mov esi, esp
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x1c], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f5c3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0CommonAuthInfo
mov byte [ebp - 4], 0x14
shr eax, 0x10
mov ecx, str.SoftwareKingsoftOffice6.0CommonAuthInfo
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x49ed79
movzx eax, cx
mov ecx, esi
push eax
call fcn.00426130
jmp 0x49ed87
push 0x2c
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
mov ecx, esi
call fcn.004263f0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004badd0
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x1c], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f587
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.fldLength
mov byte [ebp - 4], 0x15
mov ecx, esi
test eax, 0xffff0000
jne 0x49ede0
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49edec
push 9
push str.fldLength
call fcn.004263f0
push ecx
mov esi, esp
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x1c], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f5cd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x24], 0
mov ecx, esi
mov byte [ebp - 4], 0x17
jne 0x49ee2b
mov eax, str.SoftwareKingsoftOffice6.0CommonAuthInfo
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49ee37
push 0x2c
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
call fcn.004263f0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004badd0
push 0
push ecx
mov esi, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x1c], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f587
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.snld
mov byte [ebp - 4], 0x18
mov ecx, esi
test eax, 0xffff0000
jne 0x49ee8d
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49ee99
push 4
push str.snld
call fcn.004263f0
push ecx
mov esi, esp
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x1c], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f5d7
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x24], 0
mov ecx, esi
mov byte [ebp - 4], 0x1a
jne 0x49eed8
mov eax, str.SoftwareKingsoftOffice6.0CommonAuthInfo
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49eee4
push 0x2c
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
call fcn.004263f0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004badd0
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f587
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.enable
mov byte [ebp - 4], 0x1b
mov ecx, esi
test eax, 0xffff0000
jne 0x49ef3d
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49ef49
push 6
push str.enable
call fcn.004263f0
push ecx
mov esi, esp
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f5e1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0Commonhookdnsnew
mov byte [ebp - 4], 0x1d
mov ecx, esi
test eax, 0xffff0000
jne 0x49ef89
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49ef95
push 0x2e
push str.SoftwareKingsoftOffice6.0Commonhookdnsnew
call fcn.004263f0
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004badd0
push 0xffffffffffffffff
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f587
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.wps_t
mov byte [ebp - 4], 0x1e
mov ecx, esi
test eax, 0xffff0000
jne 0x49efeb
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49eff7
push 5
push str.wps_t
call fcn.004263f0
push ecx
mov esi, esp
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f5eb
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0wps
mov byte [ebp - 4], 0x20
mov ecx, esi
test eax, 0xffff0000
jne 0x49f037
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49f043
push 0x20
push str.SoftwareKingsoftOffice6.0wps
call fcn.004263f0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004bac40
push 0xffffffffffffffff
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f587
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.et_t
mov byte [ebp - 4], 0x21
mov ecx, esi
test eax, 0xffff0000
jne 0x49f099
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49f0a5
push 4
push str.et_t
call fcn.004263f0
push ecx
mov esi, esp
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f5f5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0et
mov byte [ebp - 4], 0x23
mov ecx, esi
test eax, 0xffff0000
jne 0x49f0e5
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49f0f1
push 0x1f
push str.SoftwareKingsoftOffice6.0et
call fcn.004263f0
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004bac40
push 0xffffffffffffffff
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f587
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.wpp_t
mov byte [ebp - 4], 0x24
mov ecx, esi
test eax, 0xffff0000
jne 0x49f147
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49f153
push 5
push str.wpp_t
call fcn.004263f0
push ecx
mov esi, esp
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f5ff
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0wpp
mov byte [ebp - 4], 0x26
mov ecx, esi
test eax, 0xffff0000
jne 0x49f193
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49f19f
push 0x20
push str.SoftwareKingsoftOffice6.0wpp
call fcn.004263f0
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004bac40
push 0
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f587
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.PromeWindowCount
mov byte [ebp - 4], 0x27
mov ecx, esi
test eax, 0xffff0000
jne 0x49f1f5
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49f201
push 0x10
push str.PromeWindowCount
call fcn.004263f0
push ecx
mov esi, esp
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f609
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0x29
jne 0x49f240
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49f24c
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.004263f0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004bac40
push 0
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f587
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.WindowCount
mov byte [ebp - 4], 0x2a
mov ecx, esi
test eax, 0xffff0000
jne 0x49f2a2
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49f2ae
push 0xb
push str.WindowCount
call fcn.004263f0
push ecx
mov esi, esp
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0x20], esi
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49f613
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0x2c
jne 0x49f2ed
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.00426130
jmp 0x49f2f9
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.004263f0
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004bac40
xor esi, esi
mov dword [ebp - 0x10], esi
test ebx, ebx
je 0x49f372
cmp dword [ebx], esi
je 0x49f366
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x49f32f
lea eax, [esi + 1]
jmp 0x49f38d
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49f35c
push 0
push dword [ebx]
lea ecx, [ebp - 0x10]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0CommonUserInfo
push 0x80000001
call eax
jmp 0x49f38d
mov esi, dword [ebp - 0x10]
mov eax, 1
jmp 0x49f390
cmp dword [ebx + 4], esi
jne 0x49f372
mov eax, 1
jmp 0x49f390
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0CommonUserInfo
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x49f3ed
test edi, edi
je 0x49f3a2
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x2c], 0
mov edi, esi
mov dword [ebp - 0x30], edi
test eax, eax
jne 0x49f3ed
push str.WhatNewLastCheckDate
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.WhatNewLastCheckFlag
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.WhatNewVersion
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x49f3e6
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x49f44d
cmp dword [ebx], 0
je 0x49f440
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x49f413
mov eax, 1
jmp 0x49f468
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49f446
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOffice
push 0x80000001
call eax
jmp 0x49f468
cmp dword [ebx + 4], 0
jne 0x49f44d
mov eax, 1
jmp 0x49f468
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOffice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49f4b0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x49f479
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x49f4b0
push 0x5b402c
lea ecx, [ebp - 0x30]
call fcn.004349b0
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x49f4a6
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x49f510
cmp dword [ebx], 0
je 0x49f503
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x49f4d6
mov eax, 1
jmp 0x49f52b
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49f509
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOffice
push 0x80000001
call eax
jmp 0x49f52b
cmp dword [ebx + 4], 0
jne 0x49f510
mov eax, 1
jmp 0x49f52b
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOffice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49f562
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x49f53c
push edi
call ebx
mov edi, dword [ebp - 0x20]
test eax, eax
jne 0x49f562
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x5b441c
push edi
call esi
push str.mui_file_list
push edi
call esi
test edi, edi
je 0x49f562
push edi
call ebx
xor edi, edi
lea ecx, [ebp - 0x3c]
call fcn.004bab40
test edi, edi
je 0x49f575
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00425f50
push 0x80004005
call fcn.00425f50
push 0x80004005
call fcn.00425f50
push 0x80004005
call fcn.00425f50
push 0x80004005
call fcn.00425f50
push 0x80004005
call fcn.00425f50
push 0x80004005
call fcn.00425f50
push 0x80004005
call fcn.00425f50
push 0x80004005
call fcn.00425f50
push 0x80004005
call fcn.00425f50
push 0x80004005
call fcn.00425f50
push 0x80004005
call fcn.00425f50
push 0x80004005
call fcn.00425f50
push 0x80004005
call fcn.00425f50
push 0x80004005
call fcn.00425f50
int3