Function at 0x425f80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5269f4
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x590cc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x148], ebx
test byte [0x593b48], 1
mov byte [ebp - 0x141], bl
jne 0x425ff0
or dword [0x593b48], 1
mov ecx, 0x593b1c
mov dword [ebp - 4], edi
call fcn.00408fd0
push 0x534990
call fcn.004b9fdc
add esp, 4
or esi, 0xffffffff
mov dword [ebp - 4], esi
jmp 0x425ff3
or esi, 0xffffffff
push str.createtask
mov ecx, 0x593b1c
call fcn.00408780
test al, al
je 0x426151
push str.Try_recreate_task_scheduler.
push str.kupdate::KWpsUpdateImpl::preProcessCmdLine
push 0xa6
push str.S:_rc_v11_edu_20191101_branchCoding_supportwpsupdateUpdateClient_srcmiscKWpsUpdateImpl.cpp
mov ebx, 7
push ebx
call fcn.0041a9b0
add esp, 0x14
push 0x17
xor eax, eax
push str.WPS_Office_Update_Task.
lea ecx, [ebp - 0x108]
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xf8], edi
mov word [ebp - 0x108], ax
call fcn.00402460
xor ecx, ecx
push 0xe
mov word [ebp - 0xec], cx
push str.WpsUpdateTask_
lea ecx, [ebp - 0xec]
mov dword [ebp - 4], 1
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xdc], edi
call fcn.00402460
lea edx, [ebp - 0x140]
push 0xf
push edx
mov byte [ebp - 4], 2
call fcn.0041d2b0
push 1
push 0x5a0
push 0x3c
push 8
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0xec]
push edx
push eax
mov byte [ebp - 4], 3
call fcn.0046f830
add esp, 0x24
cmp dword [ebp - 0x12c], 8
mov esi, eax
jb 0x4260d3
mov eax, dword [ebp - 0x140]
push eax
call fcn.004b9008
add esp, 4
xor ecx, ecx
cmp dword [ebp - 0xd8], 8
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x130], edi
mov word [ebp - 0x140], cx
jb 0x426100
mov edx, dword [ebp - 0xec]
push edx
call fcn.004b9008
add esp, 4
xor eax, eax
cmp dword [ebp - 0xf4], 8
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xdc], edi
mov word [ebp - 0xec], ax
mov dword [ebp - 4], 0xffffffff
jb 0x426134
mov ecx, dword [ebp - 0x108]
push ecx
call fcn.004b9008
add esp, 4
cmp esi, edi
jge 0x42623b
push esi
push str.Failed_install_update_taskschduler:_0x_08x.
push str.kupdate::KWpsUpdateImpl::preProcessCmdLine
push 0xae
jmp 0x42622d
test byte [0x593b48], 1
jne 0x426182
or dword [0x593b48], 1
mov ecx, 0x593b1c
mov dword [ebp - 4], 4
call fcn.00408fd0
push 0x534990
call fcn.004b9fdc
add esp, 4
mov dword [ebp - 4], esi
push str.deltasks
mov ecx, 0x593b1c
call fcn.00408780
test al, al
je 0x42624a
push str._deleteTask_Uninstall_update_task_scheduler.
push str.kupdate::KWpsUpdateImpl::preProcessCmdLine
push 0xb3
push str.S:_rc_v11_edu_20191101_branchCoding_supportwpsupdateUpdateClient_srcmiscKWpsUpdateImpl.cpp
push 7
call fcn.0041a9b0
add esp, 0x14
push 0xe
xor edx, edx
push str.WpsUpdateTask_
lea ecx, [ebp - 0x108]
mov dword [ebp - 0xf4], 7
mov dword [ebp - 0xf8], edi
mov word [ebp - 0x108], dx
call fcn.00402460
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 4], 5
call fcn.0046fb70
add esp, 4
cmp dword [ebp - 0xf4], 8
mov esi, eax
mov dword [ebp - 4], 0xffffffff
jb 0x426219
mov ecx, dword [ebp - 0x108]
push ecx
call fcn.004b9008
add esp, 4
cmp esi, edi
jge 0x42623b
push esi
push str.Failed_uinstall_update_task_schduler:_0x_08x.
push str.kupdate::KWpsUpdateImpl::preProcessCmdLine
push 0xb6
push str.S:_rc_v11_edu_20191101_branchCoding_supportwpsupdateUpdateClient_srcmiscKWpsUpdateImpl.cpp
push edi
call fcn.0041a9b0
add esp, 0x18
mov byte [ebp - 0x141], 1
or esi, 0xffffffff
jmp 0x426589
test byte [0x593b48], 1
jne 0x42627b
or dword [0x593b48], 1
mov ecx, 0x593b1c
mov dword [ebp - 4], 6
call fcn.00408fd0
push 0x534990
call fcn.004b9fdc
add esp, 4
mov dword [ebp - 4], esi
push str.senduninstallinfo
mov ecx, 0x593b1c
call fcn.00408780
test al, al
je 0x4262a6
call fcn.0046dd70
mov ecx, eax
call fcn.0046f5b0
mov byte [ebp - 0x141], 1
jmp 0x426589
push str.sendinstallinfo
call fcn.004014d0
mov ecx, eax
call fcn.00408780
test al, al
je 0x4262d3
call fcn.0046dd70
mov ecx, eax
call fcn.0046e8c0
mov byte [ebp - 0x141], 1
jmp 0x426589
push str.from
call fcn.004014d0
mov ecx, eax
call fcn.00408780
test al, al
je 0x426324
lea edx, [ebp - 0x108]
push str.from
push edx
call fcn.004014d0
mov ecx, eax
call fcn.00408870
push str.manual
mov ebx, 1
push eax
mov dword [ebp - 4], 7
mov dword [ebp - 0x148], ebx
call fcn.00401d10
add esp, 8
test al, al
je 0x426373
push 0x539718
call fcn.004014d0
mov ecx, eax
call fcn.00408780
test al, al
je 0x42637c
lea eax, [ebp - 0x140]
push 0x539718
push eax
call fcn.004014d0
mov ecx, eax
call fcn.00408870
push str.elevated
or ebx, 2
push eax
mov dword [ebp - 4], 8
mov dword [ebp - 0x148], ebx
call fcn.004210c0
add esp, 8
test al, al
jne 0x42637c
mov byte [ebp - 0x142], 0
jmp 0x426383
mov byte [ebp - 0x142], 1
test bl, 2
je 0x426396
lea ecx, [ebp - 0x140]
and ebx, 0xfffffffd
call fcn.0051c7a0
mov dword [ebp - 4], esi
test bl, 1
je 0x4263a9
lea ecx, [ebp - 0x108]
call fcn.0051c7a0
cmp byte [ebp - 0x142], 0
je 0x426589
push 0x3e
lea edx, [ebp - 0x4e]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0x50], cx
call fcn.004ba010
push edi
push 0x20
lea eax, [ebp - 0x50]
push eax
push str.HKCUSoftwareKingsoftOffice6.0Common_version
call fcn.0041dcb0
add esp, 0x1c
cmp eax, edi
jne 0x426589
lea eax, [ebp - 0x50]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4263f0
sub eax, edx
sar eax, 1
cmp eax, edi
jbe 0x426589
lea ecx, [ebp - 0x140]
push 1
push ecx
call fcn.0041d2b0
add esp, 8
lea eax, [ebp - 0x50]
mov dword [ebp - 4], 9
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x426425
sub eax, edx
sar eax, 1
push eax
push edi
lea edx, [ebp - 0x50]
push edx
lea ecx, [ebp - 0x140]
call fcn.00408330
cmp eax, esi
jne 0x42657b
lea eax, [ebp - 0x124]
push 0x16
push eax
call fcn.0041d2b0
push 0x7e
lea edx, [ebp - 0xce]
xor ecx, ecx
push edi
push edx
mov byte [ebp - 4], 0xa
mov word [ebp - 0xd0], cx
call fcn.004ba010
mov eax, dword [ebp - 0x124]
mov ebx, 8
add esp, 0x14
cmp dword [ebp - 0x110], ebx
jae 0x426493
lea eax, [ebp - 0x124]
push eax
push 0x40
lea eax, [ebp - 0xd0]
push eax
push 0x53a154
push str.higherversion
push 0x53db18
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
lea eax, [ebp - 0xd0]
lea edx, [eax + 2]
jmp 0x4264c0
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4264c0
sub eax, edx
sar eax, 1
cmp eax, edi
jne 0x426570
lea ecx, [ebp - 0xec]
push edi
push ecx
call fcn.0041d2b0
add esp, 8
push 0x539ff0
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 0xb
call fcn.00402600
lea edx, [ebp - 0x50]
push edx
lea ecx, [ebp - 0xec]
call fcn.00402600
push str.wtoolexwpsupdate.exe
lea ecx, [ebp - 0xec]
call fcn.00402600
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0xd8], ebx
jae 0x42652e
lea eax, [ebp - 0xec]
push eax
call fcn.0041b230
add esp, 4
test al, al
je 0x426565
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0xd8], ebx
jae 0x42654f
lea eax, [ebp - 0xec]
push edi
push str._frommanual
push eax
call fcn.00448d80
add esp, 0xc
mov byte [ebp - 0x141], 1
lea ecx, [ebp - 0xec]
call fcn.0051c7a0
lea ecx, [ebp - 0x124]
call fcn.0051c7a0
lea ecx, [ebp - 0x140]
mov dword [ebp - 4], esi
call fcn.0051c7a0
test byte [0x593b48], 1
jne 0x4265ba
or dword [0x593b48], 1
mov ecx, 0x593b1c
mov dword [ebp - 4], 0xc
call fcn.00408fd0
push 0x534990
call fcn.004b9fdc
add esp, 4
mov dword [ebp - 4], esi
push str.from
lea eax, [ebp - 0x124]
push eax
mov ecx, 0x593b1c
call fcn.00408870
mov ecx, dword [eax + 0x10]
push 6
push str.ksoend
push ecx
push edi
mov ecx, eax
mov dword [ebp - 4], 0xd
call fcn.004010d0
test eax, eax
sete bl
cmp dword [ebp - 0x110], 8
mov dword [ebp - 4], esi
jb 0x42660a
mov edx, dword [ebp - 0x124]
push edx
call fcn.004b9008
add esp, 4
xor eax, eax
mov dword [ebp - 0x110], 7
mov dword [ebp - 0x114], edi
mov word [ebp - 0x124], ax
test bl, bl
je 0x426643
call fcn.0051d060
cmp eax, 2
je 0x426635
cmp eax, edi
jne 0x426643
call fcn.00425d70
test al, al
je 0x426643
call fcn.004226e0
mov al, byte [ebp - 0x141]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret