Function at 0x4b2400
Capabilities:
Delete registry value
Link many functions at runtime
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3c4d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x63434c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
push eax
push 0x2001f
push ebx
push 0x5b3734
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4b2514
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x30]
push str..uof
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ebx
call fcn.0043a160
push str..uop
lea ecx, [ebp - 0x30]
call fcn.0043a160
push str..uos
lea ecx, [ebp - 0x30]
call fcn.0043a160
push str..uot
lea ecx, [ebp - 0x30]
call fcn.0043a160
push str.ksotheme
lea ecx, [ebp - 0x30]
call fcn.0043a160
push str.WPSSkin.WPSSkinAddin
lea ecx, [ebp - 0x30]
call fcn.0043a160
push 0x5b6ef0
lea ecx, [ebp - 0x30]
call fcn.0043a160
push str.Wps_auto_file
lea ecx, [ebp - 0x30]
call fcn.0043a160
push str.Wpsdoc.wpsdoc
lea ecx, [ebp - 0x30]
call fcn.0043a160
push str.Et_auto_file
lea ecx, [ebp - 0x30]
call fcn.0043a160
push str.Uof_auto_file
lea ecx, [ebp - 0x30]
call fcn.0043a160
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4b250a
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], 0
test ebx, ebx
je 0x4b2575
cmp dword [ebx], 0
je 0x4b2568
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4b25d3
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b256e
push 0
push dword [ebx]
lea ecx, [ebp - 0x14]
push ecx
push 0x2001f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000001
call eax
jmp 0x4b2591
cmp dword [ebx + 4], 0
jne 0x4b2575
mov eax, 1
jmp 0x4b2591
lea eax, [ebp - 0x14]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x2001f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000001
call eax
test eax, eax
jne 0x4b25d3
test edi, edi
je 0x4b259c
push edi
call esi
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b25d3
push 0x5b6f88
lea ecx, [ebp - 0x30]
call fcn.0043a160
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4b25c9
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
xor esi, esi
mov byte [ebp - 4], 3
mov dword [ebp - 0x10], esi
test ebx, ebx
je 0x4b263c
cmp dword [ebx], esi
je 0x4b2630
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b271f
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b2626
push 0
push dword [ebx]
lea ecx, [ebp - 0x10]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0Common
push 0x80000001
call eax
jmp 0x4b2657
mov esi, dword [ebp - 0x10]
mov eax, 1
jmp 0x4b265a
cmp dword [ebx + 4], esi
jne 0x4b263c
mov eax, 1
jmp 0x4b265a
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0Common
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x4b2719
test edi, edi
je 0x4b2670
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x2c], 0
mov edi, esi
mov dword [ebp - 0x30], edi
test eax, eax
jne 0x4b2719
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.Version
push esi
call ebx
push str.PersonalVersionNumber
push esi
call ebx
push str.ProfessionVersionNumber
push esi
call ebx
push str.InstallRoot
push esi
call ebx
push str.DisplayName
push esi
call ebx
push str.DistSrc
push esi
call ebx
push str.DefaultLanguage
push esi
call ebx
push str.hostprocname
push esi
call ebx
push str.category
push esi
call ebx
push str.newGuideShow
push esi
call ebx
push str.Architecture
push esi
call ebx
push str.Theme
lea ecx, [ebp - 0x30]
call fcn.0043a160
push str.plgpf
lea ecx, [ebp - 0x30]
call fcn.0043a160
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4b270f
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov byte [ebp - 4], 4
mov dword [ebp - 0x18], 0
test ebx, ebx
je 0x4b277c
cmp dword [ebx], 0
je 0x4b276f
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b27d8
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b2775
push 0
push dword [ebx]
lea ecx, [ebp - 0x18]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
push 0x80000001
call eax
jmp 0x4b2797
cmp dword [ebx + 4], 0
jne 0x4b277c
mov eax, 1
jmp 0x4b2797
lea eax, [ebp - 0x18]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b27d8
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4b27a8
push edi
call esi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b27d8
push str.qald
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4b27d1
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 5
mov dword [ebp - 0x1c], 0
test ebx, ebx
je 0x4b2839
cmp dword [ebx], 0
je 0x4b282c
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4b289c
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b2832
push 0
push dword [ebx]
lea ecx, [ebp - 0x1c]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0Commonupdateinfo
push 0x80000001
call eax
jmp 0x4b2854
cmp dword [ebx + 4], 0
jne 0x4b2839
mov eax, 1
jmp 0x4b2854
lea eax, [ebp - 0x1c]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0Commonupdateinfo
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b289c
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4b2865
push edi
call esi
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b289c
push str.cacheStatusInfo
lea ecx, [ebp - 0x30]
call fcn.0043a160
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4b2892
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov esi, dword [str.SoftwarekingsoftOffice6.0Commonupdateinfo]
mov byte [ebp - 4], 6
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4b28ff
cmp dword [ebx], 0
je 0x4b28f2
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4b2957
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b28f8
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push esi
push 0x80000001
call eax
jmp 0x4b2916
cmp dword [ebx + 4], 0
jne 0x4b28ff
mov eax, 1
jmp 0x4b2916
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b2957
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4b2927
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b2957
push str.diffcheckerror
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4b2950
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 7
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4b29ba
cmp dword [ebx], 0
je 0x4b29ad
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b2a1c
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b29b3
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0etApplication_Settings
push 0x80000001
call eax
jmp 0x4b29d5
cmp dword [ebx + 4], 0
jne 0x4b29ba
mov eax, 1
jmp 0x4b29d5
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0etApplication_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b2a16
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4b29e6
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b2a16
push str.RestartAppInfo
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4b2a0f
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov byte [ebp - 4], 8
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4b2a79
cmp dword [ebx], 0
je 0x4b2a6c
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b2ad5
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b2a72
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wpsApplication_Settings
push 0x80000001
call eax
jmp 0x4b2a94
cmp dword [ebx + 4], 0
jne 0x4b2a79
mov eax, 1
jmp 0x4b2a94
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wpsApplication_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b2ad5
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4b2aa5
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b2ad5
push str.RestartAppInfo
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4b2ace
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 9
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4b2b38
cmp dword [ebx], 0
je 0x4b2b2b
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b2b9a
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b2b31
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wppApplication_Settings
push 0x80000001
call eax
jmp 0x4b2b53
cmp dword [ebx + 4], 0
jne 0x4b2b38
mov eax, 1
jmp 0x4b2b53
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wppApplication_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b2b94
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4b2b64
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b2b94
push str.RestartAppInfo
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4b2b8d
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4b2bf7
cmp dword [ebx], 0
je 0x4b2bea
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b2c53
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b2bf0
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wpsofficeApplication_Settings
push 0x80000001
call eax
jmp 0x4b2c12
cmp dword [ebx + 4], 0
jne 0x4b2bf7
mov eax, 1
jmp 0x4b2c12
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wpsofficeApplication_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b2c53
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4b2c23
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b2c53
push str.AppComponentMode
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4b2c4c
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4b2cb6
cmp dword [ebx], 0
je 0x4b2ca9
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b2d2c
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b2caf
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0pluginskstartpage
push 0x80000001
call eax
jmp 0x4b2cd1
cmp dword [ebx + 4], 0
jne 0x4b2cb6
mov eax, 1
jmp 0x4b2cd1
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0pluginskstartpage
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b2d26
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4b2ce2
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b2d26
push str.searchRecord
lea ecx, [ebp - 0x30]
call fcn.0043a160
push str.searchRecord2
lea ecx, [ebp - 0x30]
call fcn.0043a160
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4b2d1c
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4b2d89
cmp dword [ebx], 0
je 0x4b2d7c
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b2df9
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b2d82
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOfficeclientInfo
push 0x80000001
call eax
jmp 0x4b2da4
cmp dword [ebx + 4], 0
jne 0x4b2d89
mov eax, 1
jmp 0x4b2da4
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOfficeclientInfo
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b2df9
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4b2db5
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b2df9
push 0x5c0b88
lea ecx, [ebp - 0x30]
call fcn.0043a160
push str.installInfo
lea ecx, [ebp - 0x30]
call fcn.0043a160
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4b2def
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4b2e5d
cmp dword [ebx], 0
je 0x4b2e50
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4b2e23
mov eax, 1
jmp 0x4b2e94
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b2e56
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.Environment
push 0x80000001
call eax
jmp 0x4b2e78
cmp dword [ebx + 4], 0
jne 0x4b2e5d
mov eax, 1
jmp 0x4b2e78
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.Environment
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b2e94
test edi, edi
je 0x4b2e87
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 0
test eax, eax
jne 0x4b3068
mov byte [ebp - 4], 0xe
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3db0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
push str.WPS_HOME
push edi
mov byte [ebp - 4], 0xf
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x208
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push str.PATH
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b3035
mov eax, dword [ebp - 0x20]
cmp eax, 1
je 0x4b2f06
cmp eax, 2
jne 0x4b3035
mov eax, dword [ebp - 0x24]
shr eax, 1
mov dword [ebp - 0x24], eax
je 0x4b3035
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00558012
mov ecx, dword [ebp - 0x24]
add esp, 4
mov esi, eax
add ecx, ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ecx
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push 0
push str.PATH
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b301a
mov eax, dword [ebp - 0x20]
cmp eax, 1
je 0x4b2f6a
cmp eax, 2
jne 0x4b301a
test esi, esi
je 0x4b3022
cmp dword [ebp - 0x24], 0
jne 0x4b2f7d
xor eax, eax
mov word [esi], ax
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b2f82
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x10]
call fcn.00429970
push esi
call fcn.0055801b
add esp, 4
lea ecx, [ebp - 0x10]
push 0x5b3734
push str._WPS_HOME__
call fcn.00463830
push 0x5b3734
push str.__WPS_HOME_
lea ecx, [ebp - 0x10]
call fcn.00463830
push 0x5b3734
push str._WPS_HOME_
lea ecx, [ebp - 0x10]
call fcn.00463830
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x4b3029
test esi, esi
je 0x4b3035
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b2ff0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 2
push 0
push str.PATH
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4b3035
test esi, esi
jne 0x4b2f7d
xor ecx, ecx
jmp 0x4b2f91
push str.PATH
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4b3045
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4b3068
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp + 8], 0
jne 0x4b3d93
lea ecx, [ebp - 0x3c]
call fcn.004d1090
push 0x104
push ecx
mov esi, esp
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3db0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.infoGUID
mov byte [ebp - 4], 0x11
mov ecx, esi
test eax, 0xffff0000
jne 0x4b30c2
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b30ce
push 8
push str.infoGUID
call fcn.0042a000
push ecx
mov esi, esp
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3dba
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0Common
mov byte [ebp - 4], 0x13
shr eax, 0x10
mov ecx, str.SoftwareKingsoftOffice6.0Common
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4b3116
movzx eax, cx
mov ecx, esi
push eax
call fcn.00429d30
jmp 0x4b3124
push 0x23
push str.SoftwareKingsoftOffice6.0Common
mov ecx, esi
call fcn.0042a000
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1410
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3db0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.savedump
mov byte [ebp - 4], 0x14
mov ecx, esi
test eax, 0xffff0000
jne 0x4b317d
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b3189
push 8
push str.savedump
call fcn.0042a000
push ecx
mov esi, esp
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3dc4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0x16
jne 0x4b31c8
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b31d4
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.0042a000
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1410
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3db0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.fulldump
mov byte [ebp - 4], 0x17
mov ecx, esi
test eax, 0xffff0000
jne 0x4b322d
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b3239
push 8
push str.fulldump
call fcn.0042a000
push ecx
mov esi, esp
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3dce
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0x19
jne 0x4b3278
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b3284
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.0042a000
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1410
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3db0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.wpsiu
mov byte [ebp - 4], 0x1a
mov ecx, esi
test eax, 0xffff0000
jne 0x4b32dd
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b32e9
push 5
push str.wpsiu
call fcn.0042a000
push ecx
mov esi, esp
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3dd8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0x1c
jne 0x4b3328
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b3334
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.0042a000
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1410
push 0x800
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3db0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.Pushed
mov byte [ebp - 4], 0x1d
mov ecx, esi
test eax, 0xffff0000
jne 0x4b338d
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b3399
push 6
push str.Pushed
call fcn.0042a000
push ecx
mov esi, esp
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3de2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0x1f
jne 0x4b33d8
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b33e4
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.0042a000
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1410
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x24], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3db0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, 0x5b72d4
mov byte [ebp - 4], 0x20
mov ecx, esi
test eax, 0xffff0000
jne 0x4b343d
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b3449
push 3
push 0x5b72d4
call fcn.0042a000
push ecx
mov esi, esp
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x1c], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3dec
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0CommonAuthInfo
mov byte [ebp - 4], 0x22
shr eax, 0x10
mov ecx, str.SoftwareKingsoftOffice6.0CommonAuthInfo
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x4b3491
movzx eax, cx
mov ecx, esi
push eax
call fcn.00429d30
jmp 0x4b349f
push 0x2c
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
mov ecx, esi
call fcn.0042a000
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1410
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x1c], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3db0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.fldLength
mov byte [ebp - 4], 0x23
mov ecx, esi
test eax, 0xffff0000
jne 0x4b34f8
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b3504
push 9
push str.fldLength
call fcn.0042a000
push ecx
mov esi, esp
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x1c], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3df6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x24], 0
mov ecx, esi
mov byte [ebp - 4], 0x25
jne 0x4b3543
mov eax, str.SoftwareKingsoftOffice6.0CommonAuthInfo
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b354f
push 0x2c
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
call fcn.0042a000
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1410
push 0
push ecx
mov esi, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x1c], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3db0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.snld
mov byte [ebp - 4], 0x26
mov ecx, esi
test eax, 0xffff0000
jne 0x4b35a5
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b35b1
push 4
push str.snld
call fcn.0042a000
push ecx
mov esi, esp
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x1c], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3e00
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x24], 0
mov ecx, esi
mov byte [ebp - 4], 0x28
jne 0x4b35f0
mov eax, str.SoftwareKingsoftOffice6.0CommonAuthInfo
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b35fc
push 0x2c
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
call fcn.0042a000
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1410
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3db0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.enable
mov byte [ebp - 4], 0x29
mov ecx, esi
test eax, 0xffff0000
jne 0x4b3655
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b3661
push 6
push str.enable
call fcn.0042a000
push ecx
mov esi, esp
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3e0a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0Commonhookdnsnew
mov byte [ebp - 4], 0x2b
mov ecx, esi
test eax, 0xffff0000
jne 0x4b36a1
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b36ad
push 0x2e
push str.SoftwareKingsoftOffice6.0Commonhookdnsnew
call fcn.0042a000
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1410
push 0xffffffffffffffff
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3db0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.wps_t
mov byte [ebp - 4], 0x2c
mov ecx, esi
test eax, 0xffff0000
jne 0x4b3703
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b370f
push 5
push str.wps_t
call fcn.0042a000
push ecx
mov esi, esp
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3e14
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0wps
mov byte [ebp - 4], 0x2e
mov ecx, esi
test eax, 0xffff0000
jne 0x4b374f
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b375b
push 0x20
push str.SoftwareKingsoftOffice6.0wps
call fcn.0042a000
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1290
push 0xffffffffffffffff
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3db0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.et_t
mov byte [ebp - 4], 0x2f
mov ecx, esi
test eax, 0xffff0000
jne 0x4b37b1
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b37bd
push 4
push str.et_t
call fcn.0042a000
push ecx
mov esi, esp
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3e1e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0et
mov byte [ebp - 4], 0x31
mov ecx, esi
test eax, 0xffff0000
jne 0x4b37fd
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b3809
push 0x1f
push str.SoftwareKingsoftOffice6.0et
call fcn.0042a000
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1290
push 0xffffffffffffffff
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3db0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.wpp_t
mov byte [ebp - 4], 0x32
mov ecx, esi
test eax, 0xffff0000
jne 0x4b385f
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b386b
push 5
push str.wpp_t
call fcn.0042a000
push ecx
mov esi, esp
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3e28
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0wpp
mov byte [ebp - 4], 0x34
mov ecx, esi
test eax, 0xffff0000
jne 0x4b38ab
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b38b7
push 0x20
push str.SoftwareKingsoftOffice6.0wpp
call fcn.0042a000
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1290
push 0
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3db0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.PromeWindowCount
mov byte [ebp - 4], 0x35
mov ecx, esi
test eax, 0xffff0000
jne 0x4b390d
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b3919
push 0x10
push str.PromeWindowCount
call fcn.0042a000
push ecx
mov esi, esp
mov byte [ebp - 4], 0x36
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3e32
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0x37
jne 0x4b3958
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b3964
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.0042a000
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1290
push 0
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3db0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.WindowCount
mov byte [ebp - 4], 0x38
mov ecx, esi
test eax, 0xffff0000
jne 0x4b39ba
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b39c6
push 0xb
push str.WindowCount
call fcn.0042a000
push ecx
mov esi, esp
mov byte [ebp - 4], 0x39
mov dword [ebp - 0x20], esi
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x4b3e3c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0x3a
jne 0x4b3a05
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4b3a11
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.0042a000
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 0x10
call fcn.004d1290
xor esi, esi
mov byte [ebp - 4], 0x3b
mov dword [ebp - 0x10], esi
test ebx, ebx
je 0x4b3a8f
cmp dword [ebx], esi
je 0x4b3a83
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b3b10
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b3a79
push 0
push dword [ebx]
lea ecx, [ebp - 0x10]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0CommonUserInfo
push 0x80000001
call eax
jmp 0x4b3aaa
mov esi, dword [ebp - 0x10]
mov eax, 1
jmp 0x4b3aad
cmp dword [ebx + 4], esi
jne 0x4b3a8f
mov eax, 1
jmp 0x4b3aad
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0CommonUserInfo
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x4b3b0a
test edi, edi
je 0x4b3abf
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x2c], 0
mov edi, esi
mov dword [ebp - 0x30], edi
test eax, eax
jne 0x4b3b0a
push str.WhatNewLastCheckDate
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.WhatNewLastCheckFlag
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.WhatNewVersion
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x4b3b03
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov byte [ebp - 4], 0x3c
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4b3b70
cmp dword [ebx], 0
je 0x4b3b63
push str.Advapi32.dll
call esi
test eax, eax
jne 0x4b3b36
mov eax, 1
jmp 0x4b3ba7
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b3b69
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOffice
push 0x80000001
call eax
jmp 0x4b3b8b
cmp dword [ebx + 4], 0
jne 0x4b3b70
mov eax, 1
jmp 0x4b3b8b
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOffice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b3ba7
test edi, edi
je 0x4b3b9a
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 0x10
test eax, eax
jne 0x4b3bfa
mov ecx, 0x63cd10
call fcn.004962f0
test eax, eax
setne bl
test eax, eax
je 0x4b3bc7
call fcn.0053e270
push 0x5b6f80
lea ecx, [ebp - 0x30]
call fcn.0043a160
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4b3be7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test bl, bl
je 0x4b3bf7
call fcn.00538a20
mov ebx, dword [ebp - 0x28]
xor esi, esi
mov byte [ebp - 4], 0x3d
mov dword [ebp - 0x10], esi
test ebx, ebx
je 0x4b3c63
cmp dword [ebx], esi
je 0x4b3c57
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b3cd8
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b3c4d
push 0
push dword [ebx]
lea ecx, [ebp - 0x10]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOffice
push 0x80000001
call eax
jmp 0x4b3c7e
mov esi, dword [ebp - 0x10]
mov eax, 1
jmp 0x4b3c81
cmp dword [ebx + 4], esi
jne 0x4b3c63
mov eax, 1
jmp 0x4b3c81
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOffice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x4b3cd2
test edi, edi
je 0x4b3c93
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x2c], 0
mov edi, esi
mov dword [ebp - 0x30], edi
test eax, eax
jne 0x4b3cd2
push 0x5b7370
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.mui_file_list
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x4b3ccb
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov byte [ebp - 4], 0x3e
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4b3d35
cmp dword [ebx], 0
je 0x4b3d28
push str.Advapi32.dll
call esi
test eax, eax
je 0x4b3d8b
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b3d2e
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOfficeWPS
push 0x80000001
call eax
jmp 0x4b3d50
cmp dword [ebx + 4], 0
jne 0x4b3d35
mov eax, 1
jmp 0x4b3d50
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOfficeWPS
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b3d8b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4b3d61
push edi
call ebx
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4b3d8b
push str.AddinsLF
lea ecx, [ebp - 0x30]
call fcn.0043a160
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4b3d8b
push edi
call ebx
xor edi, edi
lea ecx, [ebp - 0x3c]
call fcn.004d1180
test edi, edi
je 0x4b3d9e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00429b00
push 0x80004005
call fcn.00429b00
push 0x80004005
call fcn.00429b00
push 0x80004005
call fcn.00429b00
push 0x80004005
call fcn.00429b00
push 0x80004005
call fcn.00429b00
push 0x80004005
call fcn.00429b00
push 0x80004005
call fcn.00429b00
push 0x80004005
call fcn.00429b00
push 0x80004005
call fcn.00429b00
push 0x80004005
call fcn.00429b00
push 0x80004005
call fcn.00429b00
push 0x80004005
call fcn.00429b00
push 0x80004005
call fcn.00429b00
push 0x80004005
call fcn.00429b00
int3