Function at 0x48eaa9
Capabilities:
Check if file exists
Copy file
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c60c
mov eax, dword fs:[0]
push eax
sub esp, 0x3b8
mov eax, dword [0x62819c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [0x631d90], 0
je 0x48e15c
push 0
push 0
push 0x5ae038
push str.StepPreUninstallBegin
push 1
call fcn.004ca730
add esp, 0x14
cmp byte [0x631d90], 0
je 0x48e15c
push 0xff
push str.StepPreUninstallBegin
call fcn.004ca7b0
add esp, 8
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x48f4d4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x398], eax
mov dword [ebp - 4], 0
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x48f4de
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x37c], eax
mov byte [ebp - 4], 1
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x48f4d4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x364], eax
xor eax, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x48f4d4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x378], eax
push 0x208
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 3
push 0
push eax
call fcn.0054b380
add esp, 0xc
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x48f4d4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x374], eax
mov byte [ebp - 4], 4
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x48f4d4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x370], eax
mov byte [ebp - 4], 5
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x48f4e8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x360], eax
lea eax, [ebp - 0x36c]
mov byte [ebp - 4], 7
push eax
push dword [0x6024b8]
mov dword [ebp - 0x36c], 0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x48e372
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x36c]
test eax, eax
je 0x48e372
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x358]
push ecx
push 0
lea ecx, [ebp - 0x35c]
push ecx
push 0
push str.DistSrc
push eax
call ebx
mov eax, dword [ebp - 0x35c]
cmp eax, 1
je 0x48e2d7
cmp eax, 2
jne 0x48e372
lea ecx, [ebp - 0x360]
call fcn.00429490
mov edx, dword [ebp - 0x358]
shr edx, 1
add edx, 1
js 0x48f4fc
mov esi, dword [ebp - 0x360]
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x48e31c
push edx
lea ecx, [ebp - 0x360]
call fcn.004296d0
mov esi, dword [ebp - 0x360]
lea eax, [ebp - 0x358]
push eax
push esi
lea eax, [ebp - 0x35c]
push eax
push 0
push str.DistSrc
push dword [ebp - 0x36c]
call ebx
test eax, eax
jne 0x48e372
mov eax, dword [ebp - 0x358]
xor ecx, ecx
shr eax, 1
mov word [esi + eax*2], cx
push dword [esi - 8]
push esi
call fcn.00555593
add esp, 8
test eax, eax
js 0x48f4fc
cmp eax, dword [esi - 8]
jg 0x48f4fc
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea ecx, [ebp - 0x354]
call fcn.004b65c0
mov byte [ebp - 4], 8
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x48f4f2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x358], eax
mov eax, 0x5bbbbc
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x358]
test eax, 0xffff0000
jne 0x48e3bf
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x48e3cb
push 1
push 0x5bbbbc
call fcn.00429870
lea eax, [ebp - 0x27c]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x354]
call fcn.004b7240
mov edx, eax
cmp dword [edx + 0x14], 8
mov byte [ebp - 4], 0xb
jb 0x48e3ef
mov edx, dword [edx]
test edx, edx
jne 0x48e3f7
xor ecx, ecx
jmp 0x48e40f
mov ecx, edx
lea esi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48e400
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x358]
call fcn.00429240
mov edx, dword [ebp - 0x268]
mov byte [ebp - 4], 0xa
cmp edx, 8
jb 0x48e460
mov ecx, dword [ebp - 0x27c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x48e456
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48f506
push edx
push ecx
call fcn.00546044
add esp, 8
push 1
push 0x5bbbc0
lea ecx, [ebp - 0x358]
call fcn.00429240
mov esi, dword [0x602480]
or ebx, 0xffffffff
cmp dword [edi + 0x50], 0
je 0x48e509
push str.Preparing_to_uninstall
lea ecx, [ebp - 0x380]
call fcn.004434e0
lea eax, [ebp - 0x380]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x388]
mov ecx, 0x631c24
push eax
call fcn.004bae00
push dword [edi + 0x28]
mov byte [ebp - 4], 0xd
push dword [eax]
mov eax, dword [edi + 0x50]
push 0
push 0
push esi
call eax
mov edx, dword [ebp - 0x388]
add esp, 0x14
mov byte [ebp - 4], 0xc
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48e4e8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x380]
mov eax, ebx
mov byte [ebp - 4], 0xa
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48e509
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi + 0xfc]
cmp dword [eax - 0xc], 0
je 0x48e6c2
mov edx, dword [edi + 0x100]
cmp dword [edx - 4], 1
jle 0x48e539
push dword [edx - 0xc]
lea ecx, [edi + 0x100]
call fcn.004294f0
mov edx, dword [edi + 0x100]
mov ecx, edx
mov dword [ebp - 0x254], 0
xor eax, eax
mov dword [ebp - 0x250], 7
mov word [ebp - 0x264], ax
lea eax, [ecx + 2]
mov dword [ebp - 0x388], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48e561
sub ecx, dword [ebp - 0x388]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x264]
call fcn.0042daa0
mov edx, dword [edi + 0xfc]
mov byte [ebp - 4], 0xe
cmp dword [edx - 4], 1
jle 0x48e5a5
push dword [edx - 0xc]
lea ecx, [edi + 0xfc]
call fcn.004294f0
mov edx, dword [edi + 0xfc]
mov ecx, edx
mov dword [ebp - 0x23c], 0
xor eax, eax
mov dword [ebp - 0x238], 7
mov word [ebp - 0x24c], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48e5c7
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x24c]
call fcn.0042daa0
lea eax, [edi + 0x10]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x294]
push eax
call fcn.00496b50
push eax
lea eax, [ebp - 0x264]
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.004af1f0
add esp, 0x14
lea ecx, [ebp - 0x294]
call fcn.0042a1f0
mov edx, dword [ebp - 0x238]
mov byte [ebp - 4], 0xe
cmp edx, 8
jb 0x48e661
mov ecx, dword [ebp - 0x24c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x48e657
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48f50b
push edx
push ecx
call fcn.00546044
add esp, 8
mov edx, dword [ebp - 0x250]
xor eax, eax
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 7
mov word [ebp - 0x24c], ax
mov byte [ebp - 4], 0xa
cmp edx, 8
jb 0x48e6c2
mov ecx, dword [ebp - 0x264]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x48e6b8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48f50b
push edx
push ecx
call fcn.00546044
add esp, 8
cmp dword [edi + 0xdc], 0
mov ecx, edi
je 0x48e70c
lea eax, [ebp - 0x38c]
push eax
call fcn.0048b810
push eax
lea ecx, [edi + 0xc4]
mov byte [ebp - 4], 0x11
call fcn.0042a6a0
mov edx, dword [ebp - 0x38c]
mov eax, ebx
mov byte [ebp - 4], 0xa
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48e711
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x48e711
call fcn.004949c0
mov eax, dword [edi + 0x10]
sub eax, 0x10
push eax
call fcn.004293f0
add eax, 0x10
mov dword [ebp - 0x368], eax
lea eax, [ebp - 0x368]
mov byte [ebp - 4], 0x12
push eax
call fcn.00479790
add esp, 8
lea ecx, [ebp - 0x368]
push 0x13
push str.utilityinstall.ini
call fcn.00429240
push dword [ebp - 0x368]
xor eax, eax
push 0xa
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x5b3dbc
push str.InstallPerUser
push str.update
mov dword [ebp - 0x380], eax
call eax
lea eax, [ebp - 0x2c]
push 0x5b07b4
push eax
call fcn.00555852
add esp, 8
neg eax
sbb eax, eax
inc eax
mov dword [edi + 0xe0], eax
push dword [ebp - 0x368]
push 0x5b3dbc
push str.needAdmin
push str.update
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [edi + 0x10]
lea ecx, [ebp - 0x398]
mov dword [ebp - 0x388], eax
call fcn.00471950
test eax, eax
je 0x48f1d5
mov dword [edi + 8], 0
cmp byte [0x631d90], 0
je 0x48e820
push 0
push 0
push 0x5ae038
push str.StepPreUninstallBegin
push 1
call fcn.004ca770
add esp, 0x14
cmp byte [0x631d90], 0
je 0x48e820
push 0xff
push str.StepPreUninstallBegin
call fcn.004ca7d0
add esp, 8
push str.1388_tKUninstall::RealUninstallFunc_tuninstall_begin...
push str.H:_rc_v11_i18n_20230711_branchCoding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x631888
call fcn.004677c0
mov esi, dword [str._FPcd]
add esp, 0x10
cmp dword [edi + 0x50], 0
mov dword [ebp - 0x38c], esi
je 0x48e8d6
push str.Performing_the_preparation_before_uninstallation
lea ecx, [ebp - 0x3ac]
call fcn.004434e0
lea eax, [ebp - 0x3ac]
mov byte [ebp - 4], 0x13
push eax
lea eax, [ebp - 0x3b0]
mov ecx, 0x631c24
push eax
call fcn.004bae00
push dword [edi + 0x28]
mov byte [ebp - 4], 0x14
push dword [eax]
mov eax, dword [edi + 0x50]
push 0
push 1
push esi
call eax
mov edx, dword [ebp - 0x3b0]
add esp, 0x14
mov byte [ebp - 4], 0x13
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48e8b5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x3ac]
mov eax, ebx
mov byte [ebp - 4], 0x12
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48e8d6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [0x631d90], 0
je 0x48e912
push 0
push 0
push 0x5ae038
push str.StepExecBeforeDeleteFile
push 1
call fcn.004ca730
add esp, 0x14
cmp byte [0x631d90], 0
je 0x48e912
push 0xff
push str.StepExecBeforeDeleteFile
call fcn.004ca7b0
add esp, 8
mov ecx, edi
call fcn.00488740
cmp byte [0x631d90], 0
mov esi, eax
je 0x48e957
push 0
push 0
push 0x5ae038
push str.StepExecBeforeDeleteFile
push 1
call fcn.004ca770
add esp, 0x14
cmp byte [0x631d90], 0
je 0x48e957
push 0xff
push str.StepExecBeforeDeleteFile
call fcn.004ca7d0
add esp, 8
test esi, esi
jne 0x48e9f1
cmp dword [edi + 0x50], esi
je 0x48e9f1
push str.Failed_to_perform_the_preparation_before_uninstallation
lea ecx, [ebp - 0x3a8]
call fcn.004434e0
lea eax, [ebp - 0x3a8]
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp - 0x3b4]
mov ecx, 0x631c24
push eax
call fcn.004bae00
push dword [edi + 0x28]
mov byte [ebp - 4], 0x16
push dword [eax]
mov eax, dword [edi + 0x50]
push 2
push 1
push dword [ebp - 0x38c]
call eax
mov edx, dword [ebp - 0x3b4]
add esp, 0x14
mov byte [ebp - 4], 0x15
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48e9d0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x3a8]
mov eax, ebx
mov byte [ebp - 4], 0x12
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48e9f1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [edi + 0x50], 0
mov esi, dword [0x602488]
je 0x48ea85
push str.Deleting_files
lea ecx, [ebp - 0x3a4]
call fcn.004434e0
lea eax, [ebp - 0x3a4]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x3b8]
mov ecx, 0x631c24
push eax
call fcn.004bae00
push dword [edi + 0x28]
mov byte [ebp - 4], 0x18
push dword [eax]
mov eax, dword [edi + 0x50]
push 0
push 2
push esi
call eax
mov edx, dword [ebp - 0x3b8]
add esp, 0x14
mov byte [ebp - 4], 0x17
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48ea64
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x3a4]
mov eax, ebx
mov byte [ebp - 4], 0x12
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48ea85
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea esi, [edi + 0x10]
push esi
lea ecx, [ebp - 0x364]
call fcn.0042a6a0
lea eax, [ebp - 0x364]
push eax
call fcn.00479790
add esp, 4
lea ecx, [ebp - 0x364]
push 0x13
push str.office6KsoPost.exe
call fcn.00429240
lea eax, [ebp - 0x370]
mov ecx, edi
push eax
call fcn.00494d20
push 0xb
push str.KsoPost.exe
lea ecx, [ebp - 0x370]
call fcn.00429240
push dword [ebp - 0x364]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48eaf9
push 0
push dword [ebp - 0x370]
push dword [ebp - 0x364]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
lea ecx, [ebp - 0x378]
call fcn.0042a6a0
lea eax, [ebp - 0x378]
push eax
call fcn.00479790
add esp, 4
lea ecx, [ebp - 0x378]
push 0x13
push str.utilityinstall.ini
call fcn.00429240
push dword [ebp - 0x378]
lea eax, [ebp - 0x18]
push 3
push eax
push 0x5ad78c
push str.withKsoPost
push str.installinfo
call dword [ebp - 0x380]
push esi
lea ecx, [ebp - 0x374]
call fcn.0042a6a0
lea eax, [ebp - 0x374]
push eax
call fcn.00479790
add esp, 4
lea ecx, [ebp - 0x374]
push 0x16
push str.office6cfgs_setup.cfg
call fcn.00429240
push dword [ebp - 0x374]
lea eax, [ebp - 0x234]
push 0x104
push eax
push 0x5ac698
push str.Version
push 0x5bbd78
call dword [ebp - 0x380]
push 0
call fcn.004758b0
add esp, 4
cmp byte [0x631d90], 0
je 0x48ebe1
push 0
push 0
push 0x5ae038
push str.StepDeleteFile
push 1
call fcn.004ca730
add esp, 0x14
cmp byte [0x631d90], 0
je 0x48ebe1
push 0xff
push str.StepDeleteFile
call fcn.004ca7b0
add esp, 8
mov ecx, edi
call fcn.004865b0
mov ecx, edi
call fcn.00484930
cmp dword [edi + 0x50], 0
mov esi, dword [0x60248c]
je 0x48ec83
push str.Deleting_files
lea ecx, [ebp - 0x3a0]
call fcn.004434e0
lea eax, [ebp - 0x3a0]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x3bc]
mov ecx, 0x631c24
push eax
call fcn.004bae00
push dword [edi + 0x28]
mov byte [ebp - 4], 0x1a
push dword [eax]
mov eax, dword [edi + 0x50]
push 0
push 3
push esi
call eax
mov edx, dword [ebp - 0x3bc]
add esp, 0x14
mov byte [ebp - 4], 0x19
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48ec62
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x3a0]
mov eax, ebx
mov byte [ebp - 4], 0x12
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48ec83
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, edi
call fcn.00487210
push str.1439_tKUninstall::RealUninstallFunc_tstart_delete_old_version_product
push str.H:_rc_v11_i18n_20230711_branchCoding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x631888
call fcn.004677c0
add esp, 0x10
cmp dword [edi + 0xdc], 0
je 0x48ecc3
lea eax, [edi + 0xc4]
push eax
lea ecx, [ebp - 0x37c]
call fcn.0042a6a0
jmp 0x48ed02
lea eax, [ebp - 0x390]
mov ecx, edi
push eax
call fcn.0048dc40
push eax
lea ecx, [ebp - 0x37c]
mov byte [ebp - 4], 0x1b
call fcn.0042a6a0
mov edx, dword [ebp - 0x390]
mov eax, ebx
mov byte [ebp - 4], 0x12
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48ed02
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov esi, esp
mov dword [ebp - 0x390], esi
mov eax, dword [ebp - 0x37c]
add eax, 0xfffffff0
push eax
call fcn.004293f0
add esp, 4
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.004842f0
cmp byte [0x631d90], 0
je 0x48ed65
push 0
push 0
push 0x5ae038
push str.StepDeleteFile
push 1
call fcn.004ca770
add esp, 0x14
cmp byte [0x631d90], 0
je 0x48ed65
push 0xff
push str.StepDeleteFile
call fcn.004ca7d0
add esp, 8
push dword [ebp - 0x37c]
push str.1450_tKUninstall::RealUninstallFunc_tend_delete_old_version__ws__product
push str.H:_rc_v11_i18n_20230711_branchCoding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x631888
call fcn.004677c0
push 1
call fcn.004758b0
add esp, 0x18
lea ecx, [edi + 0x2c]
call fcn.00480db0
push str.office6werhandler.dll
lea eax, [edi + 0x10]
push eax
lea eax, [ebp - 0x3c0]
push eax
call fcn.00429080
push dword [eax]
mov byte [ebp - 4], 0x1c
call fcn.00447ab0
mov edx, dword [ebp - 0x3c0]
add esp, 0x10
mov byte [ebp - 4], 0x12
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48edda
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [edi + 0x50], 0
mov esi, dword [0x602490]
je 0x48ee6e
push str.Unregistering
lea ecx, [ebp - 0x384]
call fcn.004434e0
lea eax, [ebp - 0x384]
mov byte [ebp - 4], 0x1d
push eax
lea eax, [ebp - 0x394]
mov ecx, 0x631c24
push eax
call fcn.004bae00
push dword [edi + 0x28]
mov byte [ebp - 4], 0x1e
push dword [eax]
mov eax, dword [edi + 0x50]
push 0
push 4
push esi
call eax
mov edx, dword [ebp - 0x394]
add esp, 0x14
mov byte [ebp - 4], 0x1d
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48ee4d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x384]
mov eax, ebx
mov byte [ebp - 4], 0x12
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48ee6e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [edi + 4], 0
jne 0x48efbe
mov ecx, 0x5b01ec
lea eax, [ebp - 0x18]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x48eea6
test dx, dx
je 0x48eea2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x48eea6
add eax, 4
add ecx, 4
test dx, dx
jne 0x48ee80
xor eax, eax
jmp 0x48eeab
sbb eax, eax
or eax, 1
test eax, eax
jne 0x48efbe
call fcn.00440920
test eax, eax
je 0x48eed4
push 1
push str.WithKsoPost
call fcn.0045dcd0
add esp, 8
cmp eax, 1
jne 0x48efbe
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x48f510
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x35c], eax
mov eax, str._u__GUID___p__PipeName___n_kso__v__InstalledBuildVersion___r_0__i_0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x35c]
test eax, 0xffff0000
jne 0x48ef12
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x48ef1e
push 0x43
push str._u__GUID___p__PipeName___n_kso__v__InstalledBuildVersion___r_0__i_0
call fcn.00429870
push dword [ebp - 0x358]
lea ecx, [ebp - 0x35c]
mov byte [ebp - 4], 0x20
push str._GUID_
call fcn.0045f8f0
lea eax, [ebp - 0x234]
push eax
push str._InstalledBuildVersion_
lea ecx, [ebp - 0x35c]
call fcn.0045f8f0
mov eax, dword [ebp - 0x360]
cmp dword [eax - 0xc], 0
jne 0x48ef73
push 0xe
push str.00001.00000002
lea ecx, [ebp - 0x360]
call fcn.00429870
mov eax, dword [ebp - 0x360]
push eax
push str._PipeName_
lea ecx, [ebp - 0x35c]
call fcn.0045f8f0
mov esi, dword [ebp - 0x35c]
push 0
push 1
push 0
push 1
push 0
push esi
push dword [ebp - 0x370]
call fcn.00479aa0
add esp, 0x1c
mov byte [ebp - 4], 0x12
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x48efbe
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [0x631d90], 0
je 0x48effa
push 0
push 0
push 0x5ae038
push str.StepDeregister
push 1
call fcn.004ca730
add esp, 0x14
cmp byte [0x631d90], 0
je 0x48effa
push 0xff
push str.StepDeregister
call fcn.004ca7b0
add esp, 8
xor esi, esi
mov dword [ebp - 0x394], esi
push str.1215_tKUninstall::Deregister_tRunApp_Deregister_...
push str.H:_rc_v11_i18n_20230711_branchCoding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x631888
mov byte [ebp - 4], 0x21
call fcn.004677c0
add esp, 0x10
cmp byte [0x631d90], 0
je 0x48f05c
push esi
push esi
push 0x5ae038
push str.StepDeregisterUninstall
push 1
call fcn.004ca730
add esp, 0x14
cmp byte [0x631d90], 0
je 0x48f05c
push 0xff
push str.StepDeregisterUninstall
call fcn.004ca7b0
add esp, 8
mov ecx, edi
call fcn.004903e0
cmp byte [0x631d90], 0
mov dword [ebp - 0x384], eax
je 0x48f0a5
push 0
push 0
push 0x5ae038
push str.StepDeregisterUninstall
push 1
call fcn.004ca770
add esp, 0x14
cmp byte [0x631d90], 0
je 0x48f0a5
push 0xff
push str.StepDeregisterUninstall
call fcn.004ca7d0
add esp, 8
push dword [ebp - 0x384]
push str.1220_tKUninstall::Deregister_tRunApp_Deregister_return:_d
push str.H:_rc_v11_i18n_20230711_branchCoding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x631888
call fcn.004677c0
cmp dword [ebp - 0x384], 0
mov eax, 1
cmovne esi, eax
push esi
push str.1227_tKUninstall::Deregister_tKInsall::Deregister_return:_d
push str.H:_rc_v11_i18n_20230711_branchCoding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x631888
call fcn.004677c0
add esp, 0x28
mov byte [ebp - 4], 0x12
cmp byte [0x631d90], 0
je 0x48f16c
push 0
push 0
push 0x5ae038
push str.StepDeregister
push 1
call fcn.004ca770
add esp, 0x14
cmp byte [0x631d90], 0
je 0x48f16c
push 0xff
push str.StepDeregister
call fcn.004ca7d0
add esp, 8
cmp byte [0x631d90], 0
je 0x48f16c
push 0
push 0
push 0x5ae038
push str.StepEndUninstall
push 1
call fcn.004ca730
add esp, 0x14
cmp byte [0x631d90], 0
je 0x48f16c
push 0xff
push str.StepEndUninstall
call fcn.004ca7b0
add esp, 8
mov ecx, edi
call fcn.00483990
mov ecx, edi
call fcn.00483460
mov ecx, edi
call fcn.00482e50
push 0
call fcn.00496fe0
push eax
mov ecx, edi
call fcn.00483040
test al, al
jne 0x48f19b
push str.2293_tKUninstall::CleanQmlCache_tclean_Qml_Cache_by_recursion_failed
jmp 0x48f1b7
call fcn.00496fe0
push 1
push 0
push dword [eax]
call fcn.00479880
add esp, 0xc
test eax, eax
jne 0x48f1ce
push str.2299_tKUninstall::CleanQmlCache_tremove_empty_folder_failed
push str.H:_rc_v11_i18n_20230711_branchCoding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._ERROR_
push 0x631888
call fcn.004677c0
add esp, 0x10
mov dword [edi + 8], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x388]
cmp dword [edi + 0x50], 0
mov dword [edi + 0x4c], eax
mov esi, dword [0x602494]
je 0x48f2c1
cmp dword [edi + 8], 0
je 0x48f2c1
push str.Uninstallation_completed
lea ecx, [ebp - 0x39c]
call fcn.004434e0
lea eax, [ebp - 0x39c]
mov byte [ebp - 4], 0x22
push eax
lea eax, [ebp - 0x3c4]
mov ecx, 0x631c24
push eax
call fcn.004bae00
push dword [edi + 0x28]
mov byte [ebp - 4], 0x23
push dword [eax]
mov eax, dword [edi + 0x50]
push 0
push 5
push esi
call eax
mov edx, dword [ebp - 0x3c4]
add esp, 0x14
mov byte [ebp - 4], 0x22
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48f261
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x39c]
mov eax, ebx
mov byte [ebp - 4], 0x12
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48f282
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi + 0xd0]
cmp dword [eax - 0xc], 0
je 0x48f2c1
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push 0
push 0
push eax
push str.open
push 0
call esi
cmp eax, 0x20
jg 0x48f2c1
push 1
push 0
push dword [edi + 0xd0]
push str.iexplore
push str.open
push 0
call esi
cmp dword [edi + 0x48], 0
je 0x48f30a
push str.1508_tKUninstall::RealUninstallFunc_twait_wpsmain
push str.H:_rc_v11_i18n_20230711_branchCoding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x631888
call fcn.004677c0
add esp, 0x10
push 0xffffffffffffffff
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.1510_tKUninstall::RealUninstallFunc_twait_wpsmain_end
push str.H:_rc_v11_i18n_20230711_branchCoding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x631888
call fcn.004677c0
add esp, 0x10
push dword [edi + 0x4c]
push dword [edi + 8]
push str.1513_tKUninstall::RealUninstallFunc_tuninstall_end__return:_d__install_cost_time:_dms
push str.H:_rc_v11_i18n_20230711_branchCoding_support_newsetup_srccommonappKUninstallKUninstall.cpp
push str._INFO_
push 0x631888
call fcn.004677c0
add esp, 0x18
cmp byte [0x631d90], 0
je 0x48f368
push 0
push 0
push 0x5ae038
push str.StepEndUninstall
push 1
call fcn.004ca770
add esp, 0x14
cmp byte [0x631d90], 0
je 0x48f368
push 0xff
push str.StepEndUninstall
call fcn.004ca7d0
add esp, 8
mov edx, dword [ebp - 0x368]
mov eax, ebx
mov byte [ebp - 4], 0xa
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48f389
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x358]
mov eax, ebx
mov byte [ebp - 4], 8
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48f3aa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x354]
call fcn.00482200
mov eax, dword [ebp - 0x36c]
test eax, eax
je 0x48f3c6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x360]
mov eax, ebx
mov dword [ebp - 0x36c], 0
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48f3f1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x370]
mov eax, ebx
mov byte [ebp - 4], 4
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48f412
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x374]
mov eax, ebx
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48f433
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x378]
mov eax, ebx
mov byte [ebp - 4], 2
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48f454
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x364]
mov eax, ebx
mov byte [ebp - 4], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48f475
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x37c]
mov eax, ebx
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48f496
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x398]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x48f4b8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00545ec7
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80070057
call fcn.004293d0
call fcn.00555394
call fcn.00555394
push 0x80004005
call fcn.004293d0
int3