Function at 0x406e40
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes
Get installed programs
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x420087
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x42807c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
xor bl, bl
cmp dword [esi + 0x10], 0
mov dword [ebp - 0x2a0], esi
mov dword [ebp - 0x280], eax
mov edi, edx
jne 0x406e90
xor al, al
jmp 0x407716
cmp dword [esi + 0x14], 8
jb 0x406e9a
mov eax, dword [esi]
jmp 0x406e9c
mov eax, esi
push str.fuxin
push eax
call fcn.0041011b
add esp, 8
test eax, eax
jne 0x406ee4
push 0x9f
mov eax, str.install__typereg__keyHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallKingsoft_Office__valuenameLocationRoot__valuetypeREG_SZ
mov ecx, edi
call fcn.00401540
push 0x31
mov eax, str.http:__kad.www.wps.cn_wps_download_WPS.19.469.exe
mov ecx, esi
call fcn.00401540
mov ecx, dword [ebp - 0x280]
push 2
mov eax, 0x4240fc
call fcn.00401540
jmp 0x407712
cmp dword [esi + 0x14], 8
jb 0x406eee
mov eax, dword [esi]
jmp 0x406ef0
mov eax, esi
push str.kdubaoem
push eax
call fcn.0041011b
add esp, 8
test eax, eax
jne 0x406f26
push 0xad
mov eax, str.install__typereg__keyHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallKingsoft_Internet_Security__valuenameUninstallString__valuetypeREG_SZ
mov ecx, edi
call fcn.00401540
push 0x45
mov eax, str.http:__cd001.www.duba.net_duba_install_2011_ever_kavsetups_10_161.exe
mov ecx, esi
call fcn.00401540
jmp 0x407712
cmp dword [esi + 0x14], 8
jb 0x406f30
mov eax, dword [esi]
jmp 0x406f32
mov eax, esi
push str.kdubasafeoem
push eax
call fcn.0041011b
add esp, 8
test eax, eax
jne 0x406f68
push 0xad
mov eax, str.install__typereg__keyHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallKingsoft_Internet_Security__valuenameUninstallString__valuetypeREG_SZ
mov ecx, edi
call fcn.00401540
push 0x48
mov eax, str.http:__cd001.www.duba.net_duba_install_2011_ever_kavsetup0731_10_161.exe
mov ecx, esi
call fcn.00401540
jmp 0x407712
cmp dword [esi + 0x14], 8
jb 0x406f72
mov eax, dword [esi]
jmp 0x406f74
mov eax, esi
push str.kbaofengoem
push eax
call fcn.0041011b
add esp, 8
test eax, eax
jne 0x406fa1
push edi
mov eax, str.install__typereg__keyHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallStormPlayer__valuenameUninstallString__valuetypeREG_SZ
call fcn.00401440
push esi
mov eax, str.http:__dl.baofeng.com_baofeng5_baofeng_1115.exe
call fcn.00401440
jmp 0x407712
cmp dword [esi + 0x14], 8
jb 0x406fab
mov eax, dword [esi]
jmp 0x406fad
mov eax, esi
push str.kliveoem
push eax
call fcn.0041011b
add esp, 8
test eax, eax
jne 0x4074b6
mov eax, esi
call fcn.00404ff0
xor ebx, ebx
mov dword [ebp - 0x29c], ebx
mov dword [ebp - 0x298], ebx
mov dword [ebp - 0x294], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x278]
lea edi, [ebp - 0x29c]
mov dword [ebp - 0x278], ebx
call fcn.0040b4e0
lea eax, [ebp - 0x278]
mov dword [ebp - 0x278], ebx
call fcn.0040b4e0
lea eax, [ebp - 0x278]
mov dword [ebp - 0x278], ebx
call fcn.0040b4e0
lea eax, [ebp - 0x278]
mov dword [ebp - 0x278], ebx
call fcn.0040b4e0
push 0x206
lea edx, [ebp - 0x21a]
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0x27c], ebx
mov word [ebp - 0x21c], cx
call fcn.00412f10
add esp, 0xc
lea eax, [ebp - 0x27c]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallklive
push 0x80000002
mov dword [ebp - 0x288], 1
mov dword [ebp - 0x284], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x407286
lea ecx, [ebp - 0x284]
push ecx
mov ecx, dword [ebp - 0x27c]
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x288]
push eax
push ebx
push str.DisplayVersion
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x407286
lea eax, [ebp - 0x21c]
lea esi, [ebp - 0x238]
mov dword [ebp - 0x28c], ebx
call fcn.00401230
mov byte [ebp - 4], 1
mov dword [ebp - 0x274], 0x2e
lea ecx, [ecx]
mov eax, dword [ebp - 0x228]
cmp eax, ebx
jbe 0x40724e
mov ecx, eax
mov dword [ebp - 0x278], ecx
cmp eax, 1
jb 0x40724e
cmp dword [ebp - 0x224], 8
mov edi, dword [ebp - 0x238]
jae 0x407114
lea edi, [ebp - 0x238]
mov eax, edi
cmp ecx, ebx
jbe 0x40724e
mov edi, edi
cmp word [eax], 0x2e
je 0x407131
add eax, 2
dec ecx
jne 0x407120
jmp 0x40724e
cmp eax, ebx
je 0x40724e
mov esi, 1
lea edx, [ebp - 0x274]
mov ecx, eax
jmp 0x407150
mov bx, word [ecx]
cmp bx, word [edx]
jne 0x40721d
add ecx, 2
add edx, 2
dec esi
jne 0x407150
cmp dword [ebp - 0x224], 8
mov ecx, dword [ebp - 0x238]
jae 0x40717a
lea ecx, [ebp - 0x238]
sub eax, ecx
sar eax, 1
mov esi, eax
cmp esi, 0xffffffff
je 0x40724c
push esi
xor ecx, ecx
lea eax, [ebp - 0x254]
lea edx, [ebp - 0x238]
call fcn.00405010
push 0xffffffffffffffff
lea ecx, [esi + 1]
lea eax, [ebp - 0x270]
lea edx, [ebp - 0x238]
mov byte [ebp - 4], 2
call fcn.00405010
mov edi, eax
lea esi, [ebp - 0x238]
mov byte [ebp - 4], 3
call fcn.00401320
lea esi, [ebp - 0x270]
call fcn.00401270
cmp dword [ebp - 0x240], 8
mov eax, dword [ebp - 0x254]
jae 0x4071e8
lea eax, [ebp - 0x254]
push eax
call fcn.0040fd46
mov ecx, dword [ebp - 0x28c]
mov edx, dword [ebp - 0x29c]
mov dword [edx + ecx*4], eax
inc ecx
add esp, 4
lea esi, [ebp - 0x254]
mov dword [ebp - 0x28c], ecx
mov byte [ebp - 4], 1
call fcn.00401270
xor ebx, ebx
jmp 0x4070e0
sbb edx, edx
and edx, 0xfffffffe
inc edx
je 0x407165
mov ecx, eax
sub ecx, edi
sar ecx, 1
or edx, 0xffffffff
sub edx, ecx
mov ecx, dword [ebp - 0x278]
add ecx, edx
mov dword [ebp - 0x278], ecx
lea edi, [eax + 2]
xor ebx, ebx
jmp 0x407114
xor ebx, ebx
cmp dword [ebp - 0x224], 8
mov eax, dword [ebp - 0x238]
jae 0x407263
lea eax, [ebp - 0x238]
push eax
call fcn.0040fd46
mov ecx, dword [ebp - 0x29c]
mov edx, dword [ebp - 0x28c]
add esp, 4
lea esi, [ebp - 0x238]
mov dword [ecx + edx*4], eax
call fcn.00401270
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov byte [ebp - 4], 4
lea eax, [ebp - 0x274]
lea edi, [ebp - 0x22c]
mov dword [ebp - 0x274], 1
call fcn.0040b4e0
lea eax, [ebp - 0x274]
mov dword [ebp - 0x274], 0x15
call fcn.0040b4e0
lea eax, [ebp - 0x274]
mov dword [ebp - 0x274], ebx
call fcn.0040b4e0
lea eax, [ebp - 0x274]
mov dword [ebp - 0x274], 0x667
call fcn.0040b4e0
mov edx, dword [ebp - 0x298]
sub edx, dword [ebp - 0x29c]
mov eax, dword [ebp - 0x228]
mov edi, dword [ebp - 0x22c]
sub eax, edi
sar edx, 2
sar eax, 2
cmp eax, edx
jne 0x407387
xor ecx, ecx
cmp eax, ebx
jbe 0x407351
mov esi, dword [ebp - 0x29c]
sub edi, esi
mov dword [ebp - 0x274], edi
jmp 0x407336
mov edi, dword [ebp - 0x274]
cmp eax, ecx
jbe 0x40737b
mov edi, dword [edi + esi]
cmp edx, ecx
jbe 0x40737b
mov ebx, dword [esi]
cmp edi, ebx
jl 0x407351
jg 0x407385
inc ecx
add esi, 4
cmp ecx, eax
jb 0x407330
mov edx, dword [ebp - 0x27c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esi, [ebp - 0x22c]
call fcn.0040b540
lea esi, [ebp - 0x29c]
call fcn.0040b540
mov al, 1
jmp 0x407716
push str.invalid_vector_T__subscript
call fcn.0040ecd9
xor ebx, ebx
mov edi, dword [ebp - 0x280]
push edi
mov eax, str._S__DontPopMsgBox
call fcn.00401440
lea eax, [ebp - 0x284]
push eax
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x288]
push edx
push ebx
push str.InstallDir
push eax
mov dword [ebp - 0x284], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 0xffffffff
je 0x4073ec
mov eax, str.__Reinstall1
jmp 0x407479
mov eax, dword [ebp - 0x27c]
xor edx, edx
push eax
mov dword [ebp - 0x284], 0x104
mov word [ebp - 0x21c], dx
call esi
lea ecx, [ebp - 0x27c]
push ecx
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallKingsoft_Office
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x407451
lea edx, [ebp - 0x284]
push edx
mov edx, dword [ebp - 0x27c]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x288]
push ecx
push ebx
push str.StartMenuDir
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x284], ebx
je 0x40747f
cmp eax, ebx
jne 0x40747f
push edi
mov eax, str.__StartMenuDirectory_
call fcn.00402ba0
push edi
lea eax, [ebp - 0x21c]
call fcn.00402ba0
mov eax, 0x42474c
push edi
call fcn.00402ba0
mov eax, dword [ebp - 0x2a0]
push eax
mov eax, 0x424750
call fcn.00402ba0
mov ecx, dword [ebp - 0x27c]
push ecx
mov bl, 1
call esi
lea esi, [ebp - 0x22c]
call fcn.0040b540
lea esi, [ebp - 0x29c]
call fcn.0040b540
jmp 0x407714
cmp dword [esi + 0x14], 8
jb 0x4074c0
mov eax, dword [esi]
jmp 0x4074c2
mov eax, esi
push str.fuxinoem
push eax
call fcn.0041011b
add esp, 8
test eax, eax
jne 0x4074fb
push edi
mov eax, str.install__typereg__keyHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallFoxit_Reader_is1__valuenameInstallLocation__valuetypeREG_SZ
call fcn.00401440
push esi
mov eax, str.http:__cdn04.foxitsoftware.com_pub_foxit_reader_desktop_win_5.x_5.1_chs_FoxitReader5.1.0.1117_chs_20Setup_wps.exe
call fcn.00401440
mov eax, dword [ebp - 0x280]
push eax
mov eax, str._verysilent
jmp 0x40770d
cmp dword [esi + 0x14], 8
jb 0x407505
mov eax, dword [esi]
jmp 0x407507
mov eax, esi
push str.haoyaoem
push eax
call fcn.0041011b
add esp, 8
test eax, eax
jne 0x407540
push edi
mov eax, str.install__typereg__keyHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallHaoZip__valuenameUninstallString__valuetypeREG_SZ
call fcn.00401440
push esi
mov eax, str.http:__download.haozip.com_haozip.100021.exe
call fcn.00401440
mov ecx, dword [ebp - 0x280]
push ecx
mov eax, 0x4240fc
jmp 0x40770d
cmp dword [esi + 0x14], 8
jb 0x40754a
mov eax, dword [esi]
jmp 0x40754c
mov eax, esi
push str.foxmailoem
push eax
call fcn.0041011b
add esp, 8
test eax, eax
jne 0x4075ef
push edi
mov eax, str.install__typereg__keyHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallFoxmail__valuenameUninstallString__valuetypeREG_SZ
call fcn.00401440
push esi
mov eax, str.http:__dl_dir.qq.com_foxmail_fmch_setup.exe
call fcn.00401440
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x21a]
push eax
mov word [ebp - 0x21c], dx
call fcn.00412f10
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, dword [ebp - 0x280]
push esi
lea eax, [ebp - 0x21c]
call fcn.00401440
push esi
mov eax, str._foxmail
call fcn.00402ba0
cmp dword [esi + 0x14], 8
jb 0x4075d2
mov eax, dword [esi]
jmp 0x4075d4
mov eax, esi
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push esi
mov eax, str.__silent
call fcn.00402ba0
jmp 0x407712
cmp dword [esi + 0x14], 8
jb 0x4075f9
mov eax, dword [esi]
jmp 0x4075fb
mov eax, esi
push str.qqpcmgroem
push eax
call fcn.0041011b
add esp, 8
test eax, eax
jne 0x407628
push edi
mov eax, str.install__typereg__keyHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallQQPCMgr__valuenameUninstallString__valuetypeREG_SZ
call fcn.00401440
push esi
mov eax, str.http:__d.union.ijinshan.com_qqmrg_jm_QQPCMgr_Setup_6.6.2153.401_61687.exe
call fcn.00401440
jmp 0x407712
cmp dword [esi + 0x14], 8
jb 0x407632
mov eax, dword [esi]
jmp 0x407634
mov eax, esi
push str.powerwordoem
push eax
call fcn.0041011b
add esp, 8
test eax, eax
jne 0x407661
push edi
mov eax, str.install__typereg__keyHKEY_LOCAL_MACHINESOFTWAREkingsoftPowerWordDict__valuenameProductSerial__valuetypeREG_SZ
call fcn.00401440
push esi
mov eax, str.http:__download.iciba.com_pc_PowerWord.300.exe
call fcn.00401440
jmp 0x407712
cmp dword [esi + 0x14], 8
jb 0x40766b
mov eax, dword [esi]
jmp 0x40766d
mov eax, esi
push str.baiduinputoem
push eax
call fcn.0041011b
add esp, 8
test eax, eax
jne 0x407697
push edi
mov eax, str.install__typereg__keyHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallBaiduPinyin__valuenameUninstallString__valuetypeREG_SZ
call fcn.00401440
push esi
mov eax, str.http:__cdn.client.baidu.com_ime_05033273_BaiduPinyinSetup_1_8_2_116.exe
call fcn.00401440
jmp 0x407712
cmp dword [esi + 0x14], 8
jb 0x4076a1
mov eax, dword [esi]
jmp 0x4076a3
mov eax, esi
push str.baidubrowseroem
push eax
call fcn.0041011b
add esp, 8
test eax, eax
jne 0x4076cd
push edi
mov eax, str.install__typereg__keyHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallBaiduBrowser__valuenameUninstallString__valuetypeREG_SZ
call fcn.00401440
push esi
mov eax, str.http:__cdn.client.baidu.com_browser_promotion_2_1_8_bdbrowser_setup_ws052101_2_1_8_28.exe
call fcn.00401440
jmp 0x407712
cmp dword [esi + 0x14], 8
jb 0x4076d7
mov eax, dword [esi]
jmp 0x4076d9
mov eax, esi
push str.ksafeoem
push eax
call fcn.0041011b
add esp, 8
test eax, eax
jne 0x407714
push edi
mov eax, str.install__typereg__keyHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall_
call fcn.00401440
push esi
mov eax, 0x425650
call fcn.00401440
mov edx, dword [ebp - 0x280]
push edx
mov eax, 0x4256b0
call fcn.00401440
mov bl, 1
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040ed5d
mov esp, ebp
pop ebp
ret