Function at 0x491250
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Delete registry value
Get common file path
Parse pe header
Persist via run registry key
Persist via screensaver registry key
Print debug messages
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a0ec0
mov eax, dword fs:[0]
push eax
sub esp, 0x848
mov eax, dword [0x63434c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x720], ebx
xor eax, eax
mov dword [ebp - 0x730], eax
mov dword [ebp - 0x74c], eax
call fcn.0049bf80
push str.372_tKUninstall::ExecuteBeforeDeleteFiles_tExecute_before_delete_files_...
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
lea eax, [ebx + 0x10]
push eax
mov dword [ebp - 0x724], eax
call fcn.004801f0
add esp, 0x14
mov ecx, ebx
call fcn.0049d400
mov eax, dword [ebx + 0x84]
xor ecx, ecx
mov edx, dword [ebx + 0x88]
mov dword [ebp - 0x7b0], edx
mov esi, dword [eax]
mov dword [ebp - 0x738], esi
cmp esi, eax
je 0x4940a8
mov edi, dword [ebp - 0x7c8]
inc ecx
push edx
mov dword [ebp - 0x7ac], ecx
push ecx
mov ecx, 0x63cfb0
call fcn.004bec70
mov ecx, dword [ebp - 0x720]
mov eax, dword [ecx + 0x54]
test eax, eax
je 0x49132f
push dword [ecx + 0x28]
push dword [ebp - 0x7b0]
push dword [ebp - 0x7ac]
call eax
mov ecx, dword [ebp - 0x720]
add esp, 0xc
cmp dword [ecx + 0xdc], 0
je 0x49134b
cmp dword [ecx + 0xe0], 0
mov dword [ebp - 0x758], 1
jne 0x491355
mov dword [ebp - 0x758], 0
mov ebx, dword [esi + 8]
lea eax, [ebx + 4]
push str._sendinstalldyn
push dword [eax]
mov dword [ebp - 0x72c], eax
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x491af7
push str.office6ksomisc.exe
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x491af7
call fcn.00442100
test eax, eax
je 0x49140d
push 0
lea eax, [ebp - 0x804]
push str.InfoCollect
push eax
call fcn.00461110
mov ecx, dword [ebp - 0x730]
add esp, 0xc
or ecx, 1
mov dword [ebp - 0x730], ecx
mov dword [ebp - 0x74c], ecx
mov eax, dword [eax]
mov ecx, 0x5b4868
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4913f6
test dx, dx
je 0x4913f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4913f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4913d0
xor eax, eax
jmp 0x4913fb
sbb eax, eax
or eax, 1
mov dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x719], 1
test eax, eax
je 0x491414
mov byte [ebp - 0x719], 0
mov eax, dword [ebp - 0x730]
test al, 1
je 0x49144b
mov edx, dword [ebp - 0x804]
and eax, 0xfffffffe
mov dword [ebp - 0x730], eax
add edx, 0xfffffff0
mov dword [ebp - 0x74c], eax
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49144b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x719], 0
jne 0x494081
mov eax, dword [ebp - 0x720]
mov esi, 0x5b6e0c
cmp dword [eax + 4], 0
mov eax, 0x5b4868
cmove esi, eax
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4940e3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x72c], eax
mov dword [ebp - 4], 1
test esi, 0xffff0000
jne 0x4914ac
movzx eax, si
lea ecx, [ebp - 0x72c]
push eax
call fcn.00429d30
jmp 0x4914cd
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4914b1
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x72c]
call fcn.0042a000
mov dword [ebp - 4], 2
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4940e3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x73c], eax
mov eax, str.info_mode
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x73c]
test eax, 0xffff0000
jne 0x491512
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x49151e
push 9
push str.info_mode
call fcn.0042a000
mov byte [ebp - 4], 4
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4940e3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x748], eax
mov eax, 0x5be714
mov byte [ebp - 4], 5
shr eax, 0x10
lea ecx, [ebp - 0x748]
mov dword [ebp - 0x780], eax
test eax, eax
jne 0x49156b
mov eax, 0x5be714
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x491577
push 6
push 0x5be714
call fcn.0042a000
mov esi, dword [str.SOFTWAREKingsoftOffice6.0Uninstall]
mov byte [ebp - 4], 6
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4940e3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x744], eax
mov byte [ebp - 4], 7
test esi, esi
je 0x4915d5
test esi, 0xffff0000
jne 0x4915bf
movzx eax, si
lea ecx, [ebp - 0x744]
push eax
call fcn.00429d30
jmp 0x4915e4
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4915c4
sub ecx, edx
sar ecx, 1
jmp 0x4915d7
xor ecx, ecx
push ecx
push esi
lea ecx, [ebp - 0x744]
call fcn.0042a000
mov ecx, dword [ebp - 0x720]
lea eax, [ebp - 0x72c]
push 0
push eax
lea eax, [ebp - 0x73c]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x748]
push eax
lea eax, [ebp - 0x744]
push eax
call fcn.0049be00
mov edx, dword [ebp - 0x744]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49162f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x748]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49164d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x73c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49166b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x72c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x491690
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x720]
mov esi, 0x5b6e0c
cmp dword [eax + 0x20], 0
mov eax, 0x5b4868
cmove esi, eax
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4940e3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x744], eax
mov dword [ebp - 4], 9
test esi, 0xffff0000
jne 0x4916e4
movzx eax, si
lea ecx, [ebp - 0x744]
push eax
call fcn.00429d30
jmp 0x49170c
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4916f0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x744]
call fcn.0042a000
mov dword [ebp - 4], 0xa
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4940e3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x748], eax
mov eax, str.info_savedata
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x748]
test eax, 0xffff0000
jne 0x491751
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x49175d
push 0xd
push str.info_savedata
call fcn.0042a000
mov byte [ebp - 4], 0xc
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4940e3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x73c], eax
cmp dword [ebp - 0x780], 0
lea ecx, [ebp - 0x73c]
mov byte [ebp - 4], 0xd
jne 0x4917a1
mov eax, 0x5be714
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4917ad
push 6
push 0x5be714
call fcn.0042a000
mov esi, dword [str.SOFTWAREKingsoftOffice6.0Uninstall]
mov byte [ebp - 4], 0xe
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4940e3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x72c], eax
mov byte [ebp - 4], 0xf
test esi, esi
je 0x491811
test esi, 0xffff0000
jne 0x4917f5
movzx eax, si
lea ecx, [ebp - 0x72c]
push eax
call fcn.00429d30
jmp 0x491820
mov ecx, esi
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x491800
sub ecx, edx
sar ecx, 1
jmp 0x491813
xor ecx, ecx
push ecx
push esi
lea ecx, [ebp - 0x72c]
call fcn.0042a000
mov ecx, dword [ebp - 0x720]
lea eax, [ebp - 0x744]
push 0
push eax
lea eax, [ebp - 0x748]
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x73c]
push eax
lea eax, [ebp - 0x72c]
push eax
call fcn.0049be00
mov edx, dword [ebp - 0x72c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49186b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x73c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x491889
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x748]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4918a7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x744]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4918c5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0x11
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4940e3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x72c], eax
push 4
lea eax, [ebp - 0x72c]
mov dword [ebp - 4], 0x12
push 0x5be740
push eax
call fcn.0042c6c0
mov eax, dword [ebp - 0x72c]
lea esi, [ebx + 4]
add esp, 0xc
lea ecx, [eax - 0x10]
mov dword [ebp - 0x728], ecx
push dword [ecx + 4]
mov ecx, esi
push eax
call fcn.00429970
mov byte [ebp - 4], 0x13
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4940e3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x73c], eax
mov byte [ebp - 4], 0x15
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4940e3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x748], eax
mov byte [ebp - 4], 0x17
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4940e3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x744], eax
mov eax, dword [ebp - 0x720]
lea ecx, [ebp - 0x73c]
add eax, 0x10c
mov byte [ebp - 4], 0x18
push eax
call fcn.00429740
mov eax, dword [ebp - 0x720]
lea ecx, [ebp - 0x748]
add eax, 0x110
push eax
call fcn.00429740
mov eax, dword [ebp - 0x720]
lea ecx, [ebp - 0x744]
add eax, 0x114
push eax
call fcn.00429740
push 1
push 0x5bcef4
mov ecx, esi
call fcn.00429970
push 1
push 0x5b69ac
mov ecx, esi
call fcn.00429970
mov eax, dword [ebp - 0x73c]
push dword [eax - 0xc]
lea ecx, [eax - 0x10]
mov dword [ebp - 0x734], ecx
mov ecx, esi
push eax
call fcn.00429970
push 1
push 0x5b69ac
mov ecx, esi
call fcn.00429970
push 1
push 0x5bcef4
mov ecx, esi
call fcn.00429970
push 1
push 0x5b69ac
mov ecx, esi
call fcn.00429970
mov eax, dword [ebp - 0x748]
push dword [eax - 0xc]
lea ecx, [eax - 0x10]
mov dword [ebp - 0x750], ecx
mov ecx, esi
push eax
call fcn.00429970
push 1
push 0x5b69ac
mov ecx, esi
call fcn.00429970
push 1
push 0x5bcef4
mov ecx, esi
call fcn.00429970
push 1
push 0x5b69ac
mov ecx, esi
call fcn.00429970
mov eax, dword [ebp - 0x744]
push dword [eax - 0xc]
lea ecx, [eax - 0x10]
mov dword [ebp - 0x780], ecx
mov ecx, esi
push eax
call fcn.00429970
push 1
push 0x5b69ac
mov ecx, esi
call fcn.00429970
mov edx, dword [ebp - 0x780]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x491ab6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x750]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x491ad1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x734]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x491aec
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x728]
jmp 0x491e98
push str.office6ksomisc.exe
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x491c00
mov eax, dword [ebx + 4]
add eax, 0xfffffff0
cmp dword [eax + 4], 0x15
jg 0x491b2b
push eax
call fcn.00429b20
add esp, 4
lea edi, [eax + 0x10]
jmp 0x491bcf
mov ecx, dword [eax]
test ecx, ecx
je 0x491b47
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
je 0x491b47
mov eax, dword [ebx + 4]
mov dword [ebp - 0x73c], eax
jmp 0x491b66
call fcn.004291f0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x73c], eax
test ecx, ecx
je 0x4940e3
test eax, eax
je 0x4940f2
mov eax, dword [ecx]
push 2
push 0x15
call dword [eax]
test eax, eax
je 0x4940ed
cmp dword [eax + 8], 0x15
lea edi, [eax + 0x10]
mov dword [ebp - 0x728], edi
jl 0x4940f2
xor eax, eax
mov dword [edi - 0xc], 0x15
mov word [edi + 0x2a], ax
test edi, edi
jne 0x491bb4
call fcn.00566ade
mov dword [eax], 0x16
call fcn.00566a04
jmp 0x491bcf
mov esi, dword [ebp - 0x73c]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebp - 0x728]
mov esi, dword [ebp - 0x738]
mov eax, dword [ebp - 0x730]
or eax, 8
or eax, 2
push str._deletelink_startmenu
push edi
mov dword [ebp - 0x730], eax
mov dword [ebp - 0x74c], eax
call fcn.00566ed2
add esp, 8
mov byte [ebp - 0x719], 1
test eax, eax
je 0x491c07
mov byte [ebp - 0x719], 0
mov eax, dword [ebp - 0x730]
mov dword [ebp - 4], 0xffffffff
test al, 2
je 0x491c3f
and eax, 0xfffffffd
lea edx, [edi - 0x10]
mov dword [ebp - 0x730], eax
mov dword [ebp - 0x74c], eax
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x491c3f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x719], 0
je 0x491eb9
cmp byte [0x60e4f8], 0
je 0x4939e7
push str.433_tKUninstall::ExecuteBeforeDeleteFiles_tRead_Start_Menu_Directory_From_Windows_Registry_And_Delete_It.
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
mov byte [0x60e4f8], 0
call fcn.0046bb20
mov ecx, dword [ebp - 0x720]
lea eax, [ebp - 0x778]
add esp, 0x10
push eax
call fcn.00495330
mov eax, dword [ebp - 0x778]
mov dword [ebp - 4], 0x1a
cmp dword [eax - 0xc], 0
je 0x491e70
push eax
push str.437_tKUninstall::ExecuteBeforeDeleteFiles_tRead_Start_Menu_Directory_From_Windows_Registry_Successfully._Menu_Directory___ws
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [ebx + 4]
lea esi, [ebx + 4]
add esp, 0x14
cmp dword [eax - 0xc], 0
jl 0x491e8f
push 0x5b69ac
push eax
call fcn.0055d020
add esp, 8
test eax, eax
je 0x491e8f
sub eax, dword [esi]
sar eax, 1
cmp eax, 0xffffffff
je 0x491e8f
push eax
lea eax, [ebp - 0x75c]
mov ecx, esi
push eax
call fcn.00448c60
push 1
push 0x5b69ac
lea ecx, [ebp - 0x75c]
mov byte [ebp - 4], 0x1b
call fcn.00429970
mov eax, dword [ebp - 0x778]
lea ecx, [ebp - 0x75c]
push dword [eax - 0xc]
push eax
call fcn.00429970
push 1
push 0x5b69ac
lea ecx, [ebp - 0x75c]
call fcn.00429970
cmp dword [ebp - 0x758], 0
je 0x491dd1
mov eax, dword [ebp - 0x720]
cmp dword [eax + 0xe0], 0
je 0x491dd1
push dword [esi]
push dword [ebx]
push str.448_tKUninstall::ExecuteBeforeDeleteFiles_tSendMsgToRunProcess:_ws__params_ws
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov esi, dword [ebp - 0x75c]
add esp, 0x18
push dword [ebx + 0xc]
lea eax, [esi - 0x10]
push dword [ebx + 8]
push ecx
mov dword [ebp - 0x728], esp
mov dword [ebp - 0x838], esp
push eax
call fcn.00429b20
mov ecx, dword [ebp - 0x838]
add eax, 0x10
mov dword [ecx], eax
mov eax, esp
mov byte [ebp - 4], 0x1c
push ebx
push dword [ebp - 0x724]
push eax
call fcn.0042af40
mov ecx, dword [ebp - 0x720]
add esp, 0xc
mov byte [ebp - 4], 0x1b
call fcn.0049b780
jmp 0x491e4d
push dword [esi]
push dword [ebx]
push str.453_tKUninstall::ExecuteBeforeDeleteFiles_tRunApp:_ws__params_ws
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
push ebx
push dword [ebp - 0x724]
mov dword [ebp - 0x728], eax
lea eax, [ebp - 0x83c]
push eax
call fcn.0042af40
push 0
push 1
push 0
push esi
push dword [ebp - 0x728]
mov esi, dword [ebp - 0x75c]
push esi
push dword [eax]
mov byte [ebp - 4], 0x1d
call fcn.0047f450
mov edx, dword [ebp - 0x83c]
add esp, 0x40
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x491e4d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x491e65
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x778]
jmp 0x49405c
push str.460_tKUninstall::ExecuteBeforeDeleteFiles_tFailed_to_Read_Start_Menu_Directory_From_Windows_Registry.
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x10
lea esi, [ebx + 4]
mov edx, dword [ebp - 0x778]
add edx, 0xfffffff0
or eax, 0xffffffff
mov dword [ebp - 4], eax
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4939ea
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4939ea
push str.killproc
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x491efe
mov ebx, dword [ebp - 0x72c]
push dword [ebx]
push str.467_tKUninstall::ExecuteBeforeDeleteFiles_tKill_Process:_ws
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
push 1
push dword [ebx]
call fcn.004806b0
add esp, 0x1c
jmp 0x494081
push str.StopPluginHost
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492065
mov ecx, dword [ebp - 0x72c]
push dword [ecx]
push str.475_tKUninstall::ExecuteBeforeDeleteFiles_tStopping_wpscloudsvr:_ws
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x14
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4940e3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x774], eax
mov eax, str.wpscloudsvr
mov dword [ebp - 4], 0x1e
shr eax, 0x10
mov ecx, str.wpscloudsvr
movzx ebx, cx
lea ecx, [ebp - 0x774]
mov dword [ebp - 0x728], eax
test eax, eax
jne 0x491f85
push ebx
call fcn.00429d30
jmp 0x491f91
push 0xb
push str.wpscloudsvr
call fcn.0042a000
lea eax, [ebp - 0x774]
mov dword [ebp - 4], 0x1f
push eax
call fcn.00480130
mov edx, dword [ebp - 0x774]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x491fcc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x724]
call fcn.004801f0
add esp, 4
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4940e3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0x728], 0
lea ecx, [ebp - 0x770]
mov dword [ebp - 4], 0x20
jne 0x492015
push ebx
call fcn.00429d30
jmp 0x492021
push 0xb
push str.wpscloudsvr
call fcn.0042a000
lea eax, [ebp - 0x770]
mov dword [ebp - 4], 0x21
push eax
call fcn.00480130
mov edx, dword [ebp - 0x770]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x494081
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x494081
push str.regsvr32
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492123
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0055c530
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.System32_regsvr32.exe
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0056b327
mov ebx, dword [ebp - 0x72c]
push dword [ebx]
push str.488_tKUninstall::ExecuteBeforeDeleteFiles_tRegsvr32:_ws
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x20
lea ecx, [ebp - 0x840]
push 2
call fcn.00521ad0
push 1
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebx]
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0x22
push eax
call fcn.0047f450
add esp, 0x1c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x840]
call fcn.00521b70
jmp 0x494081
lea ecx, [ebx + 4]
push str._unregmtfont
push dword [ecx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x4921d4
push str.office6ksomisc.exe
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x4921d4
push dword [ebx + 4]
push dword [ebx]
push str.497_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x728], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x734], eax
mov eax, dword [ebx + 4]
push ebx
push dword [ebp - 0x724]
mov dword [ebp - 0x750], eax
lea eax, [ebp - 0x844]
push eax
call fcn.0042af40
push 0
push 1
push 0
push dword [ebp - 0x728]
mov dword [ebp - 4], 0x23
push dword [ebp - 0x734]
push dword [ebp - 0x750]
push dword [eax]
call fcn.0047f450
mov edx, dword [ebp - 0x844]
add esp, 0x40
jmp 0x49203d
push str._unsetappcap
push dword [ebx + 4]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492283
push str.office6ksomisc.exe
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492283
push dword [ebx + 4]
push dword [ebx]
push str.504_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x728], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x734], eax
mov eax, dword [ebx + 4]
push ebx
push dword [ebp - 0x724]
mov dword [ebp - 0x750], eax
lea eax, [ebp - 0x848]
push eax
call fcn.0042af40
push 0
push 1
push 0
push dword [ebp - 0x728]
mov dword [ebp - 4], 0x24
push dword [ebp - 0x734]
push dword [ebp - 0x750]
push dword [eax]
call fcn.0047f450
mov edx, dword [ebp - 0x848]
add esp, 0x40
jmp 0x49203d
push str._unassopic_uninstall
push dword [ebx + 4]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492332
push str.office6ksomisc.exe
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492332
push dword [ebx + 4]
push dword [ebx]
push str.511_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x728], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x734], eax
mov eax, dword [ebx + 4]
push ebx
push dword [ebp - 0x724]
mov dword [ebp - 0x750], eax
lea eax, [ebp - 0x84c]
push eax
call fcn.0042af40
push 0
push 1
push 0
push dword [ebp - 0x728]
mov dword [ebp - 4], 0x25
push dword [ebp - 0x734]
push dword [ebp - 0x750]
push dword [eax]
call fcn.0047f450
mov edx, dword [ebp - 0x84c]
add esp, 0x40
jmp 0x49203d
push str.UninstallQing
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x49237c
push str.517_tKUninstall::ExecuteBeforeDeleteFiles_tDo_Qing_Uninstall.
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
push dword [ebp - 0x724]
call fcn.004801f0
mov ecx, dword [ebp - 0x720]
add esp, 0x14
call fcn.00490d80
jmp 0x494081
push str.UninstallPdf2wordSdk
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x4923c2
call fcn.00442180
test eax, eax
je 0x494081
push str.526_tKUninstall::ExecuteBeforeDeleteFiles_tDo_Pdf2wordSdk_Uninstall.
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x10
call fcn.0049eeb0
jmp 0x494081
push str.UnRegisterDataMaster
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492414
push str.533_tKUninstall::ExecuteBeforeDeleteFiles_tDo_UnRegisterDataMaster
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov ecx, dword [ebp - 0x720]
add esp, 0x10
push 0
push 0
call fcn.004987b0
mov ecx, dword [ebp - 0x720]
push 1
push 0
call fcn.004987b0
jmp 0x494081
push str.UnRegisterKWpsWinAppExt
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492458
push str.540_tKUninstall::ExecuteBeforeDeleteFiles_tDo_UnRegisterKWpsWinAppExt
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov ecx, dword [ebp - 0x720]
add esp, 0x10
push dword [ebx + 8]
push 0
call fcn.00498d00
jmp 0x494081
push str.UnRegisterDocEncryptShellExt
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492598
push str.546_tKUninstall::ExecuteBeforeDeleteFiles_tDo_UnRegisterDocEncryptShellExt
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
push str.office6_addonsdocencryptshellext_
push dword [ebp - 0x724]
lea eax, [ebp - 0x76c]
push eax
call fcn.004297b0
add esp, 0x1c
mov dword [ebp - 4], 0x26
call fcn.0047e670
test eax, eax
mov edx, str.docencryptshellext64.dll
mov eax, str.docencryptshellext.dll
cmove edx, eax
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4924c2
sub ecx, ebx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x76c]
call fcn.00429970
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4940e3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x760], eax
mov ebx, str.user
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x760]
test ebx, 0xffff0000
jne 0x49251d
movzx eax, bx
push eax
call fcn.00429d30
jmp 0x492529
push 4
push str.user
call fcn.0042a000
mov eax, dword [ebp - 0x720]
mov byte [ebp - 4], 0x28
push 0
cmp dword [eax + 0xdc], 0
jne 0x492558
lea eax, [ebp - 0x760]
push eax
lea eax, [ebp - 0x76c]
push eax
push 0
call fcn.00449220
add esp, 0x10
jmp 0x49256f
lea ecx, [ebp - 0x760]
push ecx
lea ecx, [ebp - 0x76c]
push ecx
push 0
mov ecx, eax
call fcn.0049b6a0
mov edx, dword [ebp - 0x760]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49258d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x76c]
jmp 0x49203d
push str.UnRegisterKPdfContextMenuShellExt
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x4925ea
push str.552_tKUninstall::ExecuteBeforeDeleteFiles_tDo_UnRegisterKPdfContextMenuShellExt
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov ecx, dword [ebp - 0x720]
add esp, 0x10
push 0
push 0
call fcn.00498b90
mov ecx, dword [ebp - 0x720]
push 1
push 0
call fcn.00498b90
jmp 0x494081
push str.UninstallKingsoftVirtualPrinter
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492631
push str.559_tKUninstall::ExecuteBeforeDeleteFiles_tUninstall_kingsoft_virtual_printer.
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [ebp - 0x724]
add esp, 0x10
mov ecx, dword [ebp - 0x720]
push dword [eax]
call fcn.0049cdf0
jmp 0x494081
push str.UnRegisterPdfwspv
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x4927cb
push str.565_tKUninstall::ExecuteBeforeDeleteFiles_tUnregister_pdfwspv
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x10
call fcn.004861e0
test eax, eax
jne 0x492789
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4940e3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x77c], eax
mov eax, str._unregpdfwspv
mov dword [ebp - 4], 0x29
lea ecx, [ebp - 0x77c]
test eax, 0xffff0000
jne 0x4926b2
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4926be
push 0xd
push str._unregpdfwspv
call fcn.0042a000
push str.office6ksomisc.exe
push dword [ebp - 0x724]
lea eax, [ebp - 0x7f0]
mov dword [ebp - 4], 0x2a
push eax
call fcn.004297b0
mov ebx, eax
push 0x5bb5a8
push dword [ebp - 0x724]
lea eax, [ebp - 0x7ec]
mov byte [ebp - 4], 0x2b
push eax
call fcn.004297b0
push str.wps.exe
push eax
lea eax, [ebp - 0x850]
mov byte [ebp - 4], 0x2c
push eax
call fcn.004297b0
lea ecx, [ebp - 0x77c]
mov byte [ebp - 4], 0x2d
push ecx
push ebx
push eax
call fcn.0047f840
mov edx, dword [ebp - 0x850]
add esp, 0x30
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x492742
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x7ec]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x492760
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x7f0]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49277e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x77c]
jmp 0x49203d
push str.office6ksomisc.exe
push dword [ebp - 0x724]
lea eax, [ebp - 0x7f4]
push eax
call fcn.004297b0
push 0
push 1
push 0
push 1
push 0xffffffffffffffff
push str._unregpdfwspv
push dword [eax]
mov dword [ebp - 4], 0x2e
call fcn.0047f450
mov edx, dword [ebp - 0x7f4]
add esp, 0x28
jmp 0x49203d
push str.UninstallLockDefaultProgram
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492812
push str.576_tKUninstall::ExecuteBeforeDeleteFiles_tUninstallLockDefaultProgram
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [ebp - 0x724]
add esp, 0x10
mov ecx, dword [ebp - 0x720]
push dword [eax]
call fcn.0049d170
jmp 0x494081
push str.UnRegisterYunpan
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492875
push str.582_tKUninstall::ExecuteBeforeDeleteFiles_tDo_UnRegisterYunpan
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [ebp - 0x724]
add esp, 0x10
push 0
push ecx
mov ebx, esp
mov dword [ebp - 0x728], ebx
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00429b20
mov ecx, dword [ebp - 0x720]
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.00499100
jmp 0x494081
push str.UnRegisterPcdYunpan
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x49291c
push str.588_tKUninstall::ExecuteBeforeDeleteFiles_tDo_UnRegisterPcdYunpan
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [ebp - 0x724]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00429b20
add eax, 0x10
add esp, 0x14
mov dword [ebp - 0x72c], eax
push 0x18
push str.office6wpsclouddisk.exe
lea ecx, [ebp - 0x72c]
mov dword [ebp - 4], 0x2f
call fcn.00429970
mov esi, dword [ebp - 0x72c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4928f9
push 0
push 0
push esi
call fcn.0047e860
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x49407b
mov ecx, dword [esi]
push esi
jmp 0x494076
push str.UnRegisterOverlayIconHandles
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492a79
push str.597_tKUninstall::ExecuteBeforeDeleteFiles_tDo_UnRegisterOverlayIconHandles
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov ebx, dword [ebp - 0x720]
add esp, 0x10
mov ecx, ebx
push 0
push 0
call fcn.00498e60
push 1
push 0
mov ecx, ebx
call fcn.00498e60
mov ebx, dword [ebx + 0x108]
lea ecx, [ebp - 0x658]
push 0x15
xor eax, eax
mov dword [ebp - 0x658], 0
push str.support_MBVersionFlag
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
call fcn.0042e2d0
lea eax, [ebp - 0x658]
mov dword [ebp - 4], 0x30
push eax
lea eax, [ebp - 0x640]
mov ecx, ebx
push eax
call fcn.00443420
cmp dword [eax + 0x14], 8
jb 0x4929ce
mov eax, dword [eax]
push eax
call fcn.0056e22d
mov edx, dword [ebp - 0x62c]
add esp, 4
neg eax
sbb ebx, ebx
neg ebx
cmp edx, 8
jb 0x492a1d
mov ecx, dword [ebp - 0x640]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x492a13
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4940fc
push edx
push ecx
call fcn.00558004
add esp, 8
xor eax, eax
mov dword [ebp - 0x630], 0
mov word [ebp - 0x640], ax
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0x62c], 7
mov dword [ebp - 4], 0xffffffff
cmp eax, 8
jb 0x492a5f
inc eax
lea ecx, [ebp - 0x658]
push eax
push dword [ebp - 0x658]
call fcn.0044a180
test ebx, ebx
je 0x494081
mov ecx, dword [ebp - 0x720]
push 0
call fcn.0049b260
jmp 0x494081
push str.UninstallWPSCDiskClean
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492bc5
push str.607_tKUninstall::ExecuteBeforeDeleteFiles_tDo_WPSCDiskClean_Uninstall.
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x10
lea ecx, [ebp - 0x7b4]
push str.WpsCDiskCleanTask
call fcn.00444a50
lea eax, [ebp - 0x7b4]
mov dword [ebp - 4], 0x31
push eax
call fcn.0047a2d0
mov edx, dword [ebp - 0x7b4]
add esp, 4
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x492af9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
test ebx, ebx
setns al
push eax
push str.3953_tKUninstall::DoWPSCDiskCleanUninstall_tDelete_WpsCDiskCleanTask_tResult_d
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x14
push 0
lea eax, [ebp - 0x754]
mov dword [ebp - 4], 0x32
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREkingsoftOffice6.0pluginskcdiskclean
push 0x80000001
mov dword [ebp - 0x754], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x492b9e
push str.3958_tKUninstall::DoWPSCDiskCleanUninstall_tDelete_WpsCDiskClean_Register_createdPlanTaskcreatedDesktopLink_
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [ebp - 0x754]
add esp, 0x10
test eax, eax
je 0x492ba4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.createdPlanTask
push eax
call ebx
mov eax, dword [ebp - 0x754]
test eax, eax
je 0x492ba4
push str.createdDesktopLink
push eax
call ebx
mov eax, dword [ebp - 0x754]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x492bb6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x754], 0
jmp 0x494081
push str.DeleteExternalTask
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492c22
push str.613_tKUninstall::ExecuteBeforeDeleteFiles_tDeleting_external_task.
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x10
lea ecx, [ebp - 0x7b8]
push str.WpsExternal_
call fcn.00444a50
lea eax, [ebp - 0x7b8]
mov dword [ebp - 4], 0x33
push eax
call fcn.0047a2d0
mov edx, dword [ebp - 0x7b8]
jmp 0x49203a
push str.DeleteOemPreinstallTask
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492c7f
push str.619_tKUninstall::ExecuteBeforeDeleteFiles_tDeleting_preinstall_longon_startup_task.
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x10
lea ecx, [ebp - 0x7bc]
push str.WPSOffice_Init
call fcn.00444a50
lea eax, [ebp - 0x7bc]
mov dword [ebp - 4], 0x34
push eax
call fcn.0047a2d0
mov edx, dword [ebp - 0x7bc]
jmp 0x49203a
push str.wtoolexwpsupdatesvr.exe
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492d4b
mov esi, dword [ebx + 4]
lea eax, [ebp - 0x7f8]
push ebx
push dword [ebp - 0x724]
push eax
call fcn.0042af40
push esi
push dword [eax]
mov dword [ebp - 4], 0x35
push str.625_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov edx, dword [ebp - 0x7f8]
add esp, 0x24
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x492cf7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x728], eax
mov eax, dword [ebx + 4]
push ebx
push dword [ebp - 0x724]
mov dword [ebp - 0x734], eax
lea eax, [ebp - 0x7fc]
push eax
call fcn.0042af40
push 0
push 1
push 0
push esi
push dword [ebp - 0x728]
mov dword [ebp - 4], 0x36
push dword [ebp - 0x734]
push dword [eax]
call fcn.0047f450
mov edx, dword [ebp - 0x7fc]
jmp 0x494059
push str.wtoolexwpsnotify.exe
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
je 0x492d71
push str.wtoolexwpsupdate.exe
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492d89
push str._deltasks
push dword [ebx + 4]
call fcn.00566ed2
add esp, 8
test eax, eax
je 0x4939dd
mov eax, dword [ebp - 0x720]
mov eax, dword [eax + 0x108]
mov dword [ebp - 0x728], eax
test eax, eax
je 0x492e2b
push str.Support_UseWpsupdateXa
lea ecx, [ebp - 0x640]
call fcn.0043fa80
mov ecx, dword [ebp - 0x728]
lea eax, [ebp - 0x640]
push eax
mov dword [ebp - 4], 0x37
call fcn.0049fe60
lea ecx, [ebp - 0x640]
mov byte [ebp - 0x719], al
mov dword [ebp - 4], 0xffffffff
call fcn.0042aad0
cmp byte [ebp - 0x719], 0
je 0x492e2b
push str.wtoolexwpsnotify.exe
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
je 0x492e13
push 0x5bf460
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492e2b
push str._deltasks
push dword [ebx + 4]
call fcn.00566ed2
add esp, 8
test eax, eax
je 0x4939dd
push str.wtoolexwpsofficeupdate.exe
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
je 0x4939dd
push str.UninstallCloudSvr
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492e88
mov ecx, dword [ebp - 0x720]
call fcn.00495020
push eax
call fcn.00440a30
push eax
push str.655_tKUninstall::ExecuteBeforeDeleteFiles_t_INFO__KCloudsvrServiceReferenceMgr::tryUninstall_returned__ld
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x18
jmp 0x494081
push str.UninstallWPSDocCenter
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492fa8
push str.660_tKUninstall::ExecuteBeforeDeleteFiles_tStop_WPSDocCenter
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [ebp - 0x724]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00429b20
add eax, 0x10
add esp, 0x14
mov dword [ebp - 0x72c], eax
push 0x18
push str.office6wpsdoccenter.exe
lea ecx, [ebp - 0x72c]
mov dword [ebp - 4], 0x38
call fcn.00429970
mov esi, dword [ebp - 0x72c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x492f0c
push 0
push 0
push esi
call fcn.0047e860
add esp, 0xc
mov eax, dword [ebp - 0x720]
cmp dword [eax + 0x20], 0
jne 0x4928f9
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0055c530
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 5
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x788]
call fcn.00444a50
push 0x14
push str.WPS_MiniCloud_Files
lea ecx, [ebp - 0x788]
mov byte [ebp - 4], 0x39
call fcn.00429970
push 0
push 1
push 1
push dword [ebp - 0x788]
call fcn.0047a510
mov edx, dword [ebp - 0x788]
add esp, 0x10
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4928f9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4928f9
push str.deleteFirewallRule
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x492fe7
push str.670_tKUninstall::ExecuteBeforeDeleteFiles_tdeleteFirewallRule
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov ecx, dword [ebp - 0x720]
add esp, 0x10
call fcn.0048b0a0
jmp 0x494081
push str.msiexec.exe
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x4930c1
mov eax, dword [ebp - 0x724]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00429b20
add eax, 0x10
mov dword [ebp - 0x764], eax
lea eax, [ebp - 0x764]
mov dword [ebp - 4], 0x3a
push eax
call fcn.0047f130
add esp, 8
lea ecx, [ebp - 0x764]
push 0x13
push str.utilityinstall.ini
call fcn.00429970
push dword [ebp - 0x764]
push 0
push 0x5bf650
push str.installinfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
jne 0x4930b6
push dword [ebp - 0x764]
push 0x9c
push str.uselocal
push str.localInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0x188
jne 0x4930b6
push dword [ebx + 4]
push dword [ebx]
push str.682_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
push 1
push 0
push 0
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
push dword [ebx]
call fcn.0047f450
add esp, 0x34
mov edx, dword [ebp - 0x764]
jmp 0x49203d
push str.office6ksomisc.exe
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x4931a9
mov eax, dword [ebx + 4]
cmp dword [eax - 0xc], 0
jl 0x4931a9
push str._deletetaskbarpin
push eax
call fcn.0055d020
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x4931a9
sub ecx, dword [ebx + 4]
sar ecx, 1
cmp ecx, 0xffffffff
je 0x4931a9
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.0055c530
add esp, 0xc
lea eax, [ebp - 0x628]
push 0
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4939e7
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x784]
call fcn.00444a50
push 0x19
push str.KingsoftOffice6TaskBar
lea ecx, [ebp - 0x784]
mov dword [ebp - 4], 0x3b
call fcn.00429970
push 0
push 1
push 1
push dword [ebp - 0x784]
call fcn.0047a510
mov edx, dword [ebp - 0x784]
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4939e7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4939e7
push str.office6WPSOfficePIA.exe
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x4931ee
push dword [ebx + 4]
push dword [ebx]
push str.702_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov ecx, dword [ebp - 0x720]
add esp, 0x18
push ebx
call fcn.004910d0
jmp 0x494081
push str.UninstallKtpcntr
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x4932b6
push str.708_tKUninstall::ExecuteBeforeDeleteFiles_tUninstallKtpcntr
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x10
lea ecx, [ebp - 0x7c0]
push str.WpsKtpcntrQingTask_
call fcn.00444a50
lea eax, [ebp - 0x7c0]
mov dword [ebp - 4], 0x3c
push eax
call fcn.0047a2d0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c0]
call fcn.00429660
push dword [ebp - 0x724]
lea ecx, [ebp - 0x7a4]
call fcn.00487cf0
push str.office6ktpcntr.exe
lea ecx, [ebp - 0x7a4]
mov dword [ebp - 4], 0x3d
call fcn.004894e0
mov esi, dword [ebp - 0x7a4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49329f
push 0
push 0
push esi
call fcn.0047e860
add esp, 0xc
lea ecx, [ebp - 0x7a4]
mov dword [ebp - 4], 0xffffffff
call fcn.00429660
jmp 0x49407b
push str.UninstallSurvey
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x493571
push str.718_tKUninstall::ExecuteBeforeDeleteFiles_tUninstallSurvey
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [ebp - 0x720]
lea ecx, [ebp - 0x640]
add esp, 0x10
mov ebx, dword [eax + 0x108]
push str.Support_UninstallSurvey
call fcn.0043fa80
lea eax, [ebp - 0x640]
mov dword [ebp - 4], 0x3e
push eax
lea eax, [ebp - 0x658]
mov ecx, ebx
push eax
call fcn.00443420
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0x3f
jb 0x49332d
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x7e0]
call fcn.00444a50
lea ecx, [ebp - 0x658]
call fcn.0042aad0
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 0x42
call fcn.0042aad0
push 0x5b6494
push dword [ebp - 0x7e0]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x49355a
lea ecx, [ebp - 0x718]
call fcn.004bf840
mov ecx, dword [ebp - 0x720]
push dword [ebp - 0x72c]
add ecx, 0xd0
mov byte [ebp - 4], 0x43
call fcn.00429740
lea eax, [ebp - 0x640]
push eax
lea ecx, [ebp - 0x718]
call fcn.004bfd20
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0x44
jb 0x4933b2
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x82c]
call fcn.00444a50
mov ebx, eax
push str._distsrc
lea ecx, [ebp - 0x7c4]
mov byte [ebp - 4], 0x45
call fcn.00444960
push ebx
lea eax, [ebp - 0x7c4]
mov byte [ebp - 4], 0x46
push eax
lea eax, [ebp - 0x800]
push eax
call fcn.0042af40
add esp, 0xc
mov ecx, dword [ebp - 0x720]
push eax
mov byte [ebp - 4], 0x47
lea ecx, [ecx + 0xd0]
call fcn.00489440
lea ecx, [ebp - 0x800]
call fcn.00429660
lea ecx, [ebp - 0x7c4]
call fcn.00429660
lea ecx, [ebp - 0x82c]
call fcn.00429660
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 0x43
call fcn.0042aad0
lea eax, [ebp - 0x80c]
mov ecx, 0x63cf7c
push eax
call fcn.004c2670
mov ebx, eax
push str.lang
lea ecx, [ebp - 0x7d8]
mov byte [ebp - 4], 0x48
call fcn.00444960
push ebx
lea eax, [ebp - 0x7d8]
mov byte [ebp - 4], 0x49
push eax
lea eax, [ebp - 0x808]
push eax
call fcn.0042af40
add esp, 0xc
mov ecx, dword [ebp - 0x720]
push eax
mov byte [ebp - 4], 0x4a
lea ecx, [ecx + 0xd0]
call fcn.00489440
lea ecx, [ebp - 0x808]
call fcn.00429660
lea ecx, [ebp - 0x7d8]
call fcn.00429660
lea ecx, [ebp - 0x80c]
mov byte [ebp - 4], 0x43
call fcn.00429660
lea eax, [ebp - 0x640]
push eax
lea ecx, [ebp - 0x718]
call fcn.004c0880
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0x4b
jb 0x4934d0
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x814]
call fcn.00444a50
mov ebx, eax
push 0x5bf8e4
lea ecx, [ebp - 0x7dc]
mov byte [ebp - 4], 0x4c
call fcn.00444960
push ebx
lea eax, [ebp - 0x7dc]
mov byte [ebp - 4], 0x4d
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.0042af40
add esp, 0xc
mov ecx, dword [ebp - 0x720]
push eax
mov byte [ebp - 4], 0x4e
lea ecx, [ecx + 0xd0]
call fcn.00489440
lea ecx, [ebp - 0x810]
call fcn.00429660
lea ecx, [ebp - 0x7dc]
call fcn.00429660
lea ecx, [ebp - 0x814]
call fcn.00429660
lea ecx, [ebp - 0x640]
call fcn.0042aad0
lea ecx, [ebp - 0x718]
call fcn.004885c0
lea ecx, [ebp - 0x7e0]
mov dword [ebp - 4], 0xffffffff
call fcn.00429660
jmp 0x494081
push str.UninstallKscreenSaver
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x493934
push str.733_tKUninstall::ExecuteBeforeDeleteFiles_tDeleting_WpsKscreenSaver__Task.
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
add esp, 0x10
push str._kscreen__Delte_WpsKscreenSaver__Task
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.WpsKscreenSaver_
lea ecx, [ebp - 0x7e4]
call fcn.00444a50
lea eax, [ebp - 0x7e4]
mov dword [ebp - 4], 0x4f
push eax
call fcn.0047a2d0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7e4]
call fcn.00429660
push str.office6_addonsksslinkerksslinker.dll
push dword [ebp - 0x724]
lea eax, [ebp - 0x818]
push eax
call fcn.004297b0
add esp, 0xc
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [ebp - 0x818]
mov ebx, eax
call fcn.00429660
test ebx, ebx
je 0x494081
mov ebx, dword [ebp - 0x724]
lea ecx, [ebp - 0x79c]
push ebx
call fcn.00487cf0
push str.office6_addonskscreensaverlauncher
lea ecx, [ebp - 0x79c]
mov dword [ebp - 4], 0x50
call fcn.004894e0
push 0
push 1
push 1
push dword [ebp - 0x79c]
call fcn.0047a510
add esp, 0x10
lea ecx, [ebp - 0x798]
push ebx
call fcn.00487cf0
push str.office6_addonskscrsvr
lea ecx, [ebp - 0x798]
mov byte [ebp - 4], 0x51
call fcn.004894e0
push 0
push 1
push 1
push dword [ebp - 0x798]
call fcn.0047a510
add esp, 0x10
lea eax, [ebp - 0x740]
mov dword [ebp - 0x740], 0
push eax
push 0x20019
push 0
push str.Control_PanelDesktop
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x794]
call fcn.0042a980
lea eax, [ebp - 0x794]
mov byte [ebp - 4], 0x53
push eax
push str.SCRNSAVE.EXE
lea ecx, [ebp - 0x740]
call fcn.00496b70
push 0xb
lea eax, [ebp - 0x81c]
push eax
lea ecx, [ebp - 0x794]
call fcn.00429ef0
push str.kscrsvr.scr
push dword [eax]
call fcn.00566ed2
add esp, 8
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x81c]
mov ebx, eax
call fcn.00429660
test ebx, ebx
jne 0x493735
mov eax, dword [ebp - 0x740]
test eax, eax
je 0x49374a
push 2
push 0x5b3734
push 1
push ebx
push str.SCRNSAVE.EXE
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x740]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x493750
push eax
call ebx
jmp 0x493750
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.756_tKUninstall::ExecuteBeforeDeleteFiles_tDeleting_KScreensaverPendant_PowerBoot_regedit.
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
mov dword [ebp - 0x740], 0
call fcn.0046bb20
add esp, 0x10
push str._kscreen__Deleting_KScreensaverPendant_PowerBoot_regedit.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x740]
test eax, eax
je 0x49378e
push eax
call ebx
lea eax, [ebp - 0x740]
mov dword [ebp - 0x740], 0
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x790]
call fcn.0042a980
lea eax, [ebp - 0x790]
mov byte [ebp - 4], 0x55
push eax
push str.KScreenSaverPendant
lea ecx, [ebp - 0x740]
call fcn.00496b70
mov eax, dword [ebp - 0x790]
cmp dword [eax - 0xc], 0
je 0x4937fe
mov eax, dword [ebp - 0x740]
test eax, eax
je 0x49380b
push str.KScreenSaverPendant
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x740]
test eax, eax
je 0x49380b
push eax
call ebx
mov ebx, dword [ebp - 0x724]
lea eax, [ebp - 0x768]
push str.office6wps.exe
push ebx
push eax
mov dword [ebp - 0x740], 0
call fcn.004297b0
push ebx
lea eax, [ebp - 0x820]
mov byte [ebp - 4], 0x56
push str.Run__InstanceIdsslinker__
push eax
call fcn.00438f80
push str.office6_addonsksslinkerksslinker.dll___uninst
push eax
lea eax, [ebp - 0x78c]
mov byte [ebp - 4], 0x57
push eax
call fcn.004297b0
add esp, 0x24
lea ecx, [ebp - 0x820]
mov byte [ebp - 4], 0x59
call fcn.00429660
call fcn.004861e0
test eax, eax
je 0x4938a3
push str._kscreen__Running_uninst_in_Admin_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push 1
push 0
push 0
push dword [0x60e4fc]
push dword [ebp - 0x78c]
push dword [ebp - 0x768]
call fcn.0047f450
add esp, 0x1c
jmp 0x4938cb
push str._kscreen__Running_uninst_in_low_user_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [0x60e4fc]
lea eax, [ebp - 0x78c]
push eax
lea eax, [ebp - 0x768]
push eax
push eax
call fcn.0047f990
add esp, 0x10
lea ecx, [ebp - 0x78c]
call fcn.00429660
lea ecx, [ebp - 0x768]
call fcn.00429660
lea ecx, [ebp - 0x790]
call fcn.00429660
lea ecx, [ebp - 0x794]
call fcn.00429660
mov eax, dword [ebp - 0x740]
test eax, eax
je 0x493908
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x798]
mov dword [ebp - 0x740], 0
call fcn.00429660
lea ecx, [ebp - 0x79c]
mov dword [ebp - 4], 0xffffffff
call fcn.00429660
jmp 0x494081
push str.SupportWPS365
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x4939e7
mov dword [ebp - 0x7d4], eax
mov dword [ebp - 0x7d0], eax
mov dword [ebp - 0x7cc], eax
push 0x2001f
push str.SOFTWAREkingsoft
mov dword [ebp - 4], 0x5a
call fcn.0051ca50
push eax
lea ecx, [ebp - 0x7d4]
call fcn.004965a0
test eax, eax
jne 0x4939aa
push str.WPS365
lea ecx, [ebp - 0x7d4]
call fcn.0043a160
mov eax, dword [ebp - 0x7d4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4939b6
push eax
call ebx
xor eax, eax
jmp 0x4939b6
mov eax, dword [ebp - 0x7d4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x4939ce
push eax
call ebx
mov dword [ebp - 0x7d4], 0
mov dword [ebp - 0x7d0], 0
jmp 0x494081
mov dword [ebp - 0x758], 0
lea esi, [ebx + 4]
push str.office6ksomisc.exe
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x493aac
mov eax, dword [esi]
add eax, 0xfffffff0
mov ecx, dword [eax + 4]
mov dword [ebp - 0x728], ecx
cmp ecx, 0x11
jg 0x493a28
push eax
call fcn.00429b20
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x7a0], esi
jmp 0x493a6a
mov ecx, dword [eax]
test ecx, ecx
je 0x493a39
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x493a47
call fcn.004291f0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
mov eax, dword [esi]
mov edx, dword [ebp - 0x728]
push ecx
push 0x11
lea ecx, [ebp - 0x7a0]
lea eax, [eax + edx*2]
add eax, 0xffffffde
push eax
call fcn.00487d20
mov esi, dword [ebp - 0x7a0]
mov eax, dword [ebp - 0x730]
or eax, 0x10
or eax, 4
push str._forceperusermode
push esi
mov dword [ebp - 0x730], eax
mov dword [ebp - 0x74c], eax
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x493ab2
mov eax, dword [ebp - 0x720]
cmp dword [eax + 0xdc], 0
je 0x493ab2
mov byte [ebp - 0x719], 1
jmp 0x493ab9
mov esi, dword [ebp - 0x7a0]
mov byte [ebp - 0x719], 0
mov eax, dword [ebp - 0x730]
mov dword [ebp - 4], 0xffffffff
test al, 4
je 0x493af1
and eax, 0xfffffffb
add esi, 0xfffffff0
mov dword [ebp - 0x730], eax
mov dword [ebp - 0x74c], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x493af1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x719], 0
je 0x493c2d
mov esi, dword [ebx + 4]
mov eax, dword [ebp - 0x724]
mov dword [ebp - 4], 0x5c
mov eax, dword [eax]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x493b20
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x493b2c
call fcn.004291f0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov byte [ebp - 4], 0x5d
test eax, eax
je 0x4940e3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov ecx, dword [ebp - 0x724]
add eax, 0x10
mov dword [ebp - 0x7e8], eax
mov eax, dword [ebp - 0x730]
or eax, 0x20
mov byte [ebp - 4], 0x5c
mov ecx, dword [ecx]
mov dword [ebp - 0x730], eax
mov dword [ebp - 0x74c], eax
mov eax, dword [ebx]
push dword [eax - 0xc]
push eax
push dword [ecx - 0xc]
lea eax, [ebp - 0x7e8]
push ecx
push eax
call fcn.0042b690
push esi
mov esi, dword [ebp - 0x7e8]
push esi
push str.798_tKUninstall::ExecuteBeforeDeleteFiles_tSend_msg_to_run_app:_ws__params_ws
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [ebp - 0x730]
add esp, 0x2c
and eax, 0xffffffdf
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x730], eax
add esi, 0xfffffff0
mov dword [ebp - 0x74c], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x493bd7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx + 0xc]
mov eax, dword [ebx + 4]
push dword [ebx + 8]
sub eax, 0x10
push ecx
mov esi, esp
mov dword [ebp - 0x728], esp
push eax
mov dword [ebp - 0x734], esi
call fcn.00429b20
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0x5e
mov eax, esp
push ebx
push dword [ebp - 0x724]
push eax
call fcn.0042af40
mov ecx, dword [ebp - 0x720]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
call fcn.0049b780
jmp 0x49407b
push str._unregmso2pdfplugins
push dword [ebx + 4]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x493cc5
push str.office6ksomisc.exe
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x493cc5
push str.805_tKUninstall::ExecuteBeforeDeleteFiles_tUnRegistering_KMso2PdfPlugins.
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x728], eax
mov eax, dword [ebx + 4]
push ebx
push dword [ebp - 0x724]
mov dword [ebp - 0x734], eax
lea eax, [ebp - 0x824]
push eax
call fcn.0042af40
push 0
push 1
push 0
push esi
push dword [ebp - 0x728]
mov dword [ebp - 4], 0x5f
push dword [ebp - 0x734]
push dword [eax]
call fcn.0047f450
mov edx, dword [ebp - 0x824]
jmp 0x493df4
push str._unreghtml2PdfPlugins
push dword [ebx + 4]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x493d5d
push str.office6ksomisc.exe
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x493d5d
push str.811_tKUninstall::ExecuteBeforeDeleteFiles_tUnRegistering_KHtml2PdfPlugins.
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x728], eax
mov eax, dword [ebx + 4]
push ebx
push dword [ebp - 0x724]
mov dword [ebp - 0x734], eax
lea eax, [ebp - 0x828]
push eax
call fcn.0042af40
push 0
push 1
push 0
push esi
push dword [ebp - 0x728]
mov dword [ebp - 4], 0x60
push dword [ebp - 0x734]
push dword [eax]
call fcn.0047f450
mov edx, dword [ebp - 0x828]
jmp 0x493df4
push str._delJsapiCert
push dword [ebx + 4]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x493e0f
push str.office6ksomisc.exe
push dword [ebx]
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x493e0f
push str.817_tKUninstall::ExecuteBeforeDeleteFiles_tdelJsapiCert.
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x728], eax
mov eax, dword [ebx + 4]
push ebx
push dword [ebp - 0x724]
mov dword [ebp - 0x734], eax
lea eax, [ebp - 0x854]
push eax
call fcn.0042af40
push 0
push 1
push 0
push esi
push dword [ebp - 0x728]
mov dword [ebp - 4], 0x61
push dword [ebp - 0x734]
push dword [eax]
call fcn.0047f450
mov edx, dword [ebp - 0x854]
add esp, 0x38
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x493e0f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebx + 4]
mov eax, dword [ebp - 0x724]
mov dword [ebp - 4], 0x62
mov eax, dword [eax]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x493e31
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x493e3d
call fcn.004291f0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov byte [ebp - 4], 0x63
test eax, eax
je 0x4940e3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov ecx, dword [ebp - 0x724]
add eax, 0x10
mov dword [ebp - 0x7a8], eax
mov eax, dword [ebp - 0x730]
or eax, 0x80
mov byte [ebp - 4], 0x62
mov ecx, dword [ecx]
mov dword [ebp - 0x730], eax
mov dword [ebp - 0x74c], eax
mov eax, dword [ebx]
push dword [eax - 0xc]
push eax
push dword [ecx - 0xc]
lea eax, [ebp - 0x7a8]
push ecx
push eax
call fcn.0042b690
push esi
mov esi, dword [ebp - 0x7a8]
push esi
push str.820_tKUninstall::ExecuteBeforeDeleteFiles_tRun_App:_ws__params_ws
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [ebp - 0x730]
add esp, 0x2c
and eax, 0xffffff7f
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x730], eax
add esi, 0xfffffff0
mov dword [ebp - 0x74c], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x493eec
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x758], 0
je 0x493fa9
mov eax, dword [ebp - 0x720]
cmp dword [eax + 0xe0], 0
je 0x493fa9
cmp dword [ebx + 0x10], 0
jne 0x493fa9
mov esi, dword [ebx + 4]
lea eax, [ebp - 0x830]
push ebx
push dword [ebp - 0x724]
push eax
call fcn.0042af40
push esi
push dword [eax]
mov dword [ebp - 4], 0x64
push str.823_tKUninstall::ExecuteBeforeDeleteFiles_tSendMsgToRunProcess:_ws__params_ws
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov edx, dword [ebp - 0x830]
add esp, 0x24
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x493f77
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx + 0xc]
mov eax, dword [ebx + 4]
push dword [ebx + 8]
sub eax, 0x10
push ecx
mov esi, esp
mov dword [ebp - 0x728], esp
push eax
mov dword [ebp - 0x734], esi
call fcn.00429b20
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0x65
jmp 0x493c04
mov esi, dword [ebx + 4]
lea eax, [ebp - 0x834]
push ebx
push dword [ebp - 0x724]
push eax
call fcn.0042af40
push esi
push dword [eax]
mov dword [ebp - 4], 0x66
push str.828_tKUninstall::ExecuteBeforeDeleteFiles_tRunApp:_ws__params_ws
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov edx, dword [ebp - 0x834]
add esp, 0x24
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49400a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x728], eax
mov eax, dword [ebx + 4]
push ebx
push dword [ebp - 0x724]
mov dword [ebp - 0x734], eax
lea eax, [ebp - 0x7c8]
push eax
call fcn.0042af40
push 0
push 1
push 0
push esi
push dword [ebp - 0x728]
mov dword [ebp - 4], 0x67
push dword [ebp - 0x734]
push dword [eax]
call fcn.0047f450
mov edx, dword [ebp - 0x7c8]
add esp, 0x28
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49407b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x738]
mov eax, dword [ebp - 0x720]
mov esi, dword [esi]
mov dword [ebp - 0x738], esi
cmp esi, dword [eax + 0x84]
je 0x4940a8
mov ecx, dword [ebp - 0x7ac]
mov edx, dword [ebp - 0x7b0]
jmp 0x4912f5
call fcn.00442100
test eax, eax
je 0x4940bd
push 0
push 0
call fcn.00460e70
add esp, 8
call fcn.0043a450
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00557e89
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00429b00
call fcn.0042a100
push 0x80070057
call fcn.00429b00
call fcn.00566a14
int3