Function at 0x44c202
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push 0x24
mov eax, 0x487c11
call fcn.00468a6e
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
mov edi, 0x104
mov esi, SysReAllocString
mov ebx, 0x2001f
cmp dword [ecx + 0x1c], eax
jne 0x44c4e7
lea ecx, [ebp - 0x30]
call fcn.0046131e
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.infoGUID
mov byte [ebp - 4], 1
call fcn.00418067
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.SoftwareKingsoftOffice6.0Common
mov byte [ebp - 4], 2
call fcn.00418067
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00461426
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.savedump
call fcn.00418067
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.SoftwareKingsoftOffice6.0Common
mov byte [ebp - 4], 3
call fcn.00418067
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00461426
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.fulldump
call fcn.00418067
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.SoftwareKingsoftOffice6.0Common
mov byte [ebp - 4], 4
call fcn.00418067
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00461426
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.wpsiu
call fcn.00418067
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.SoftwareKingsoftOffice6.0Common
mov byte [ebp - 4], 5
call fcn.00418067
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00461426
push 0x800
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Pushed
call fcn.00418067
mov byte [ebp - 4], 6
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.SoftwareKingsoftOffice6.0Common
call fcn.00418067
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00461426
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x49819c
call fcn.00418067
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
mov byte [ebp - 4], 7
call fcn.00418067
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00461426
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.snld
call fcn.00418067
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
mov byte [ebp - 4], 8
call fcn.00418067
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00461426
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.enable
call fcn.00418067
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.SoftwareKingsoftOffice6.0Commonhookdnsnew
mov byte [ebp - 4], 9
call fcn.00418067
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00461426
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.wps_t
call fcn.00418067
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.SoftwareKingsoftOffice6.0wps
mov byte [ebp - 4], 0xa
call fcn.00418067
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00461380
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.et_t
call fcn.00418067
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.SoftwareKingsoftOffice6.0et
mov byte [ebp - 4], 0xb
call fcn.00418067
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00461380
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.wpp_t
call fcn.00418067
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.SoftwareKingsoftOffice6.0wpp
mov byte [ebp - 4], 0xc
call fcn.00418067
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00461380
push ebx
push str.SoftwareKingsoftOffice6.0CommonUserInfo
push esi
lea ecx, [ebp - 0x20]
call fcn.0042483e
test eax, eax
jne 0x44c4b3
push str.WhatNewLastCheckDate
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.WhatNewLastCheckFlag
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.WhatNewVersion
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x20]
call fcn.00424823
push ebx
push str.SoftwareKingsoftOffice
push esi
lea ecx, [ebp - 0x20]
call fcn.0042483e
test eax, eax
jne 0x44c4db
push 0x48f5e8
lea ecx, [ebp - 0x20]
call fcn.004249e4
lea ecx, [ebp - 0x20]
call fcn.00424823
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.0046132b
push ebx
push str.SoftwareKingsoftOffice6.0Common
push esi
lea ecx, [ebp - 0x20]
call fcn.0042483e
test eax, eax
jne 0x44c50f
push str.updateinfo
lea ecx, [ebp - 0x20]
call fcn.004249e4
lea ecx, [ebp - 0x20]
call fcn.00424823
push ebx
push 0x48c308
push SysReAllocString
lea ecx, [ebp - 0x20]
call fcn.0042483e
test eax, eax
jne 0x44c5c1
push str..uof
lea ecx, [ebp - 0x20]
call fcn.004249e4
push str..uop
lea ecx, [ebp - 0x20]
call fcn.004249e4
push str..uos
lea ecx, [ebp - 0x20]
call fcn.004249e4
push str..uot
lea ecx, [ebp - 0x20]
call fcn.004249e4
push str.ksotheme
lea ecx, [ebp - 0x20]
call fcn.004249e4
push str.WPSSkin.WPSSkinAddin
lea ecx, [ebp - 0x20]
call fcn.004249e4
push 0x48ed78
lea ecx, [ebp - 0x20]
call fcn.004249e4
push str.Wps_auto_file
lea ecx, [ebp - 0x20]
call fcn.004249e4
push str.Wpsdoc.wpsdoc
lea ecx, [ebp - 0x20]
call fcn.004249e4
push str.Et_auto_file
lea ecx, [ebp - 0x20]
call fcn.004249e4
push str.Uof_auto_file
lea ecx, [ebp - 0x20]
call fcn.004249e4
lea ecx, [ebp - 0x20]
call fcn.00424823
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x20]
call fcn.0042483e
test eax, eax
jne 0x44c5ee
push str.wpsautoupdate
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x20]
call fcn.00424823
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push esi
lea ecx, [ebp - 0x20]
call fcn.0042483e
test eax, eax
jne 0x44c616
push str.Kingsoft_Office
lea ecx, [ebp - 0x20]
call fcn.004249e4
lea ecx, [ebp - 0x20]
call fcn.00424823
push ebx
push str.SOFTWAREkingsoftOffice
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x20]
call fcn.0042483e
test eax, eax
jne 0x44c642
push 0x48f5e8
lea ecx, [ebp - 0x20]
call fcn.004249e4
lea ecx, [ebp - 0x20]
call fcn.00424823
push ebx
push str.SOFTWAREkingsoftOffice
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x20]
call fcn.0042483e
test eax, eax
jne 0x44c66e
push 0x48f988
lea ecx, [ebp - 0x20]
call fcn.004249e4
lea ecx, [ebp - 0x20]
call fcn.00424823
push ebx
push str.SOFTWAREkingsoftOffice
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x20]
call fcn.0042483e
test eax, eax
jne 0x44c69a
push str.Addins
lea ecx, [ebp - 0x20]
call fcn.004249e4
lea ecx, [ebp - 0x20]
call fcn.00424823
push ebx
push dword [0x4be798]
lea ecx, [ebp - 0x20]
push esi
call fcn.0042483e
test eax, eax
jne 0x44c6c4
push str.diffcheckerror
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x20]
call fcn.00424823
push ebx
push str.SoftwarekingsoftOffice6.0etApplication_Settings
push esi
lea ecx, [ebp - 0x20]
call fcn.0042483e
test eax, eax
jne 0x44c6ed
push str.RestartAppInfo
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x20]
call fcn.00424823
push ebx
push str.SoftwarekingsoftOffice6.0wpsApplication_Settings
push esi
lea ecx, [ebp - 0x20]
call fcn.0042483e
test eax, eax
jne 0x44c716
push str.RestartAppInfo
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x20]
call fcn.00424823
push ebx
push str.SoftwarekingsoftOffice6.0wppApplication_Settings
push esi
lea ecx, [ebp - 0x20]
call fcn.0042483e
test eax, eax
jne 0x44c73f
push str.RestartAppInfo
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x20]
call fcn.00424823
push ebx
push str.SoftwareKingsoftOffice6.0Common
push esi
lea ecx, [ebp - 0x20]
call fcn.0042483e
test eax, eax
jne 0x44c767
push str.Theme
lea ecx, [ebp - 0x20]
call fcn.004249e4
lea ecx, [ebp - 0x20]
call fcn.00424823
push ebx
push str.SoftwarekingsoftOffice6.0Common
push esi
lea ecx, [ebp - 0x20]
call fcn.0042483e
test eax, eax
jne 0x44c7e4
push str.Version
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.PersonalVersionNumber
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.ProfessionVersionNumber
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.InstallRoot
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.DisplayName
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.DistSrc
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.DefaultLanguage
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x20]
call fcn.00424823
push ebx
push str.Environment
push esi
lea ecx, [ebp - 0x20]
call fcn.0042483e
test eax, eax
jne 0x44c8d7
push 0x4c1160
lea ecx, [ebp - 0x10]
call fcn.004237f4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.WPS_HOME
push dword [ebp - 0x20]
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x14], edi
call ebx
lea eax, [ebp - 0x14]
push eax
push 0
mov edi, str.PATH
push edi
lea ecx, [ebp - 0x20]
call fcn.0042488d
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x44c8c4
xor ecx, ecx
push 2
add eax, 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00468ca0
pop ecx
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push esi
push edi
lea ecx, [ebp - 0x20]
call fcn.0042488d
push esi
lea ecx, [ebp - 0x10]
call fcn.00417f66
push esi
call fcn.00468bd4
pop ecx
mov esi, 0x48c308
push esi
push str._WPS_HOME__
lea ecx, [ebp - 0x10]
call fcn.0043ce0e
push esi
push str.__WPS_HOME_
lea ecx, [ebp - 0x10]
call fcn.0043ce0e
push esi
push str._WPS_HOME_
lea ecx, [ebp - 0x10]
call fcn.0043ce0e
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x44c8bc
push 2
push esi
push edi
lea ecx, [ebp - 0x20]
call fcn.00448f29
jmp 0x44c8c7
push edi
push dword [ebp - 0x20]
call ebx
jmp 0x44c8c7
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x20]
call fcn.00424823
lea ecx, [esi - 0x10]
call fcn.00417891
lea ecx, [ebp - 0x20]
call fcn.00424823
call fcn.00468b46
ret