Function at 0x48d140
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c350
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x62819c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0048ce30
test al, al
jne 0x48d3ed
mov ecx, esi
call fcn.0048d500
test al, al
jne 0x48d3ed
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x48d401
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
call fcn.00515dd0
mov ecx, dword [ebp - 0x10]
mov ebx, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ecx, ecx
je 0x48d1c9
push ecx
call edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push str.KingsoftOffice6.0CommonUserInfo
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [ebp - 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x18], 0
test eax, eax
je 0x48d2a0
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
push str.ACUPI
push eax
call ebx
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x48d21d
cmp eax, 2
jne 0x48d29d
lea ecx, [ebp - 0x14]
call fcn.00429490
mov edx, dword [ebp - 0x18]
shr edx, 1
add edx, 1
js 0x48d40b
mov esi, dword [ebp - 0x14]
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x48d253
push edx
lea ecx, [ebp - 0x14]
call fcn.004296d0
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push 0
push str.ACUPI
push dword [ebp - 0x10]
call ebx
test eax, eax
jne 0x48d29d
mov eax, dword [ebp - 0x18]
xor ecx, ecx
shr eax, 1
mov word [esi + eax*2], cx
push dword [esi - 8]
push esi
call fcn.00555593
add esp, 8
test eax, eax
js 0x48d40b
cmp eax, dword [esi - 8]
jg 0x48d40b
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov eax, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
jne 0x48d386
test eax, eax
je 0x48d2b1
push eax
call edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push str.KingsoftOffice6.0CommonUserInfo
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], 0
test eax, eax
je 0x48d38d
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
push str.ACUPI
push eax
call ebx
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x48d303
cmp eax, 2
jne 0x48d383
lea ecx, [ebp - 0x14]
call fcn.00429490
mov ecx, dword [ebp - 0x18]
shr ecx, 1
add ecx, 1
js 0x48d40b
mov esi, dword [ebp - 0x14]
mov edx, 1
mov eax, dword [esi - 8]
sub edx, dword [esi - 4]
sub eax, ecx
or eax, edx
jge 0x48d339
push ecx
lea ecx, [ebp - 0x14]
call fcn.004296d0
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push 0
push str.ACUPI
push dword [ebp - 0x10]
call ebx
test eax, eax
jne 0x48d383
mov eax, dword [ebp - 0x18]
xor ecx, ecx
shr eax, 1
mov word [esi + eax*2], cx
push dword [esi - 8]
push esi
call fcn.00555593
add esp, 8
test eax, eax
js 0x48d40b
cmp eax, dword [esi - 8]
jg 0x48d40b
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x48d38d
push eax
call edi
push 0x5b07b4
push esi
mov dword [ebp - 0x10], 0
call fcn.00555852
xor ebx, ebx
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x10]
sete bl
test eax, eax
je 0x48d3b3
push eax
call edi
mov dword [ebp - 0x10], 0
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x48d3d9
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004293d0
push 0x80070057
call fcn.004293d0
int3