Function at 0x44c6e9
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
push ebx
xor ebx, ebx
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.00455d86
push ebx
push 1
push 0x5455c8
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x44c753
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x44c747
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [0x5455f4]
test eax, eax
mov dword [ebp - 0xc], ebx
jne 0x44c734
call fcn.004566b6
mov eax, dword [0x5455f4]
cmp dword [eax + 4], ebx
je 0x44c747
mov eax, dword [eax + 0x34]
cmp eax, ebx
je 0x44c747
call eax
lea edi, [ebp - 0x10]
call fcn.0044ba6d
pop edi
pop ebx
leave
ret
mov eax, dword [0x5438cc]
push esi
mov ecx, 0x5438cc
call dword [eax + 0xc]
add eax, 0x10
push 0x104
lea esi, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.004015aa
push ebx
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [ebp - 4]
cmp esi, ebx
jne 0x44c78a
xor eax, eax
jmp 0x44c792
push esi
call dword [sym.imp.MSVCR80.dll_wcslen]
pop ecx
lea edx, [ebp - 4]
call fcn.00401354
mov eax, dword [esi - 0xc]
cmp eax, ebx
je 0x44ca33
lea ecx, [eax - 1]
cmp ecx, ebx
jl 0x44ca4a
cmp ecx, eax
jg 0x44ca4a
cmp word [esi + ecx*2], 0x5c
je 0x44c7cd
push 0x4da9e4
lea eax, [ebp - 4]
push eax
call fcn.00407371
push str.kingsoftkiskisfreeOEM32.ini
lea eax, [ebp - 4]
push eax
call fcn.00407371
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44ca33
lea esi, [ebp - 0x38]
xor edi, edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
call fcn.0044b8e4
test eax, eax
je 0x44c820
mov esi, dword [ebp - 0x34]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
test eax, eax
jle 0x44c815
inc edi
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
cmp edi, ebx
jne 0x44c82d
lea esi, [ebp - 0x38]
call fcn.0044b8b6
jmp 0x44ca33
lea esi, [ebp - 0x38]
call fcn.0044b8b6
push 0x40e
lea eax, [ebp - 0x452]
push ebx
push eax
mov word [ebp - 0x454], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push dword [ebp - 4]
lea eax, [ebp - 0x454]
push 0x207
push eax
push 0x50edd8
push 0x51622c
mov esi, str.HTML1
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jb 0x44ca33
push dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push ebx
push str.DelayTime
push esi
call edi
push dword [ebp - 4]
mov dword [ebp - 0x3c], eax
push ebx
push str.ADSID
push esi
call edi
push dword [ebp - 4]
mov dword [ebp - 0x1c], eax
push 1
push str.ShowLoop
push esi
call edi
push dword [ebp - 4]
mov dword [ebp - 8], eax
push 1
push str.Interval
push esi
call edi
mov edi, dword [ebp - 0x1c]
cmp edi, ebx
mov dword [ebp - 0x28], eax
jle 0x44ca33
cmp dword [0x5455bc], ebx
jne 0x44c963
lea eax, [ebp - 0x14]
push eax
push 0x20219
push ebx
push str.softwarekingsoft_antivirus
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44c963
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push str.LastADSID
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call esi
test eax, eax
jne 0x44c928
mov eax, dword [ebp - 0x24]
mov dword [0x5455bc], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push str.LastADShowTime
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 8
call esi
test eax, eax
jne 0x44c95a
mov eax, dword [ebp - 0x44]
mov dword [0x5455c0], eax
mov eax, dword [ebp - 0x40]
mov dword [0x5455c4], eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x5455bc], edi
jne 0x44c974
cmp dword [ebp - 8], ebx
jle 0x44ca33
mov edi, dword [sym.imp.MSVCR80.dll__time64]
push ebx
call edi
mov esi, eax
sub esi, dword [0x5455c0]
mov eax, dword [ebp - 0x28]
pop ecx
mov ecx, edx
sbb ecx, dword [0x5455c4]
imul eax, eax, 0xe10
cdq
cmp ecx, edx
jl 0x44ca33
jg 0x44c9aa
cmp esi, eax
jbe 0x44ca33
push ebx
call edi
mov dword [0x5455c0], eax
mov eax, dword [ebp - 0x1c]
pop ecx
mov dword [0x5455bc], eax
lea eax, [ebp - 8]
push eax
push 0x20206
push ebx
push str.softwarekingsoft_antivirus
push SysReAllocStringLen
mov dword [0x5455c4], edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44ca16
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
push 0x5455bc
push 4
push ebx
push str.LastADSID
push dword [ebp - 8]
call esi
push 8
push 0x5455c0
push 3
push ebx
push str.LastADShowTime
push dword [ebp - 8]
call esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
jle 0x44ca23
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx]
push ebx
lea edx, [ebp - 0x454]
push edx
call dword [eax + 0x10]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
mov dword [0x5455c8], ebx
call fcn.00401239
pop esi
jmp 0x44c716
push 0x80070057
call fcn.004016a9
int3