Function at 0x48fb60
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5802d0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x5fb61c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
push 0x2001f
push 0x591ff8
push 0x80000000
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.00438000
test eax, eax
jne 0x48fc58
push str..uof
lea ecx, [ebp - 0x24]
call fcn.00438290
push str..uop
lea ecx, [ebp - 0x24]
call fcn.00438290
push str..uos
lea ecx, [ebp - 0x24]
call fcn.00438290
push str..uot
lea ecx, [ebp - 0x24]
call fcn.00438290
push str.ksotheme
lea ecx, [ebp - 0x24]
call fcn.00438290
push str.WPSSkin.WPSSkinAddin
lea ecx, [ebp - 0x24]
call fcn.00438290
push 0x594cb8
lea ecx, [ebp - 0x24]
call fcn.00438290
push str.Wps_auto_file
lea ecx, [ebp - 0x24]
call fcn.00438290
push str.Wpsdoc.wpsdoc
lea ecx, [ebp - 0x24]
call fcn.00438290
push str.Et_auto_file
lea ecx, [ebp - 0x24]
call fcn.00438290
push str.Uof_auto_file
lea ecx, [ebp - 0x24]
call fcn.00438290
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x48fc55
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
push 0x2001f
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000001
lea ecx, [ebp - 0x24]
call fcn.00438000
test eax, eax
jne 0x48fc94
push str.Kingsoft_Office
lea ecx, [ebp - 0x24]
call fcn.00438290
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x48fc91
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
push 0x2001f
push str.SoftwarekingsoftOffice6.0Common
push 0x80000001
lea ecx, [ebp - 0x24]
call fcn.00438000
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x48fd3a
mov esi, dword [ebp - 0x24]
push str.Version
push esi
call edi
push str.PersonalVersionNumber
push esi
call edi
push str.ProfessionVersionNumber
push esi
call edi
push str.InstallRoot
push esi
call edi
push str.DisplayName
push esi
call edi
push str.DistSrc
push esi
call edi
push str.DefaultLanguage
push esi
call edi
push str.hostprocname
push esi
call edi
push 0x5a60ec
push esi
call edi
push str.newGuideShow
push esi
call edi
push str.Theme
lea ecx, [ebp - 0x24]
call fcn.00438290
push str.plgpf
lea ecx, [ebp - 0x24]
call fcn.00438290
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x48fd37
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
push 0x2001f
push str.SoftwareKingsoftOffice6.0Commonupdateinfo
push 0x80000001
lea ecx, [ebp - 0x24]
call fcn.00438000
test eax, eax
jne 0x48fd76
push str.cacheStatusInfo
lea ecx, [ebp - 0x24]
call fcn.00438290
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x48fd73
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov eax, dword [str.SoftwarekingsoftOffice6.0Commonupdateinfo]
push 0x2001f
push eax
push 0x80000001
lea ecx, [ebp - 0x24]
call fcn.00438000
test eax, eax
jne 0x48fdae
mov esi, dword [ebp - 0x24]
push str.diffcheckerror
push esi
call edi
cmp esi, ebx
je 0x48fdab
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
push 0x2001f
push str.SoftwarekingsoftOffice6.0etApplication_Settings
push 0x80000001
lea ecx, [ebp - 0x24]
call fcn.00438000
test eax, eax
jne 0x48fde5
mov esi, dword [ebp - 0x24]
push str.RestartAppInfo
push esi
call edi
cmp esi, ebx
je 0x48fde2
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
push 0x2001f
push str.SoftwarekingsoftOffice6.0wpsApplication_Settings
push 0x80000001
lea ecx, [ebp - 0x24]
call fcn.00438000
test eax, eax
jne 0x48fe1c
mov esi, dword [ebp - 0x24]
push str.RestartAppInfo
push esi
call edi
cmp esi, ebx
je 0x48fe19
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
push 0x2001f
push str.SoftwarekingsoftOffice6.0wppApplication_Settings
push 0x80000001
lea ecx, [ebp - 0x24]
call fcn.00438000
test eax, eax
jne 0x48fe53
mov esi, dword [ebp - 0x24]
push str.RestartAppInfo
push esi
call edi
cmp esi, ebx
je 0x48fe50
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
push 0x2001f
push str.SoftwarekingsoftOffice6.0wpsofficeApplication_Settings
push 0x80000001
lea ecx, [ebp - 0x24]
call fcn.00438000
test eax, eax
jne 0x48fe8a
mov esi, dword [ebp - 0x24]
push str.AppComponentMode
push esi
call edi
cmp esi, ebx
je 0x48fe87
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
push 0x2001f
push str.SoftwarekingsoftOffice6.0pluginskstartpage
push 0x80000001
lea ecx, [ebp - 0x24]
call fcn.00438000
test eax, eax
jne 0x48fed3
push str.searchRecord
lea ecx, [ebp - 0x24]
call fcn.00438290
push str.searchRecord2
lea ecx, [ebp - 0x24]
call fcn.00438290
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x48fed0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
push 0x2001f
push str.Environment
push 0x80000001
lea ecx, [ebp - 0x24]
call fcn.00438000
mov ebx, 2
test eax, eax
jne 0x49006c
mov edx, dword [0x5fcb00]
mov eax, dword [edx + 0xc]
mov ecx, 0x5fcb00
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x24]
push str.WPS_HOME
push esi
mov byte [ebp - 4], 1
call edi
lea ecx, [ebp - 0x14]
push ecx
push 0
lea edx, [ebp - 0x18]
push edx
push 0
push str.PATH
push esi
mov dword [ebp - 0x14], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x490030
mov eax, dword [ebp - 0x18]
cmp eax, 1
je 0x48ff53
cmp eax, ebx
jne 0x490030
mov eax, dword [ebp - 0x14]
shr eax, 1
mov dword [ebp - 0x18], eax
je 0x490030
xor ecx, ecx
add eax, 2
mov edx, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00534575
add esp, 4
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push edi
push str.PATH
lea ecx, [ebp - 0x24]
call fcn.004380b0
test edi, edi
jne 0x48ff96
xor eax, eax
jmp 0x48ffae
mov eax, edi
lea edx, [eax + 2]
jmp 0x48ffa0
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x48ffa0
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0x10]
call fcn.00422060
push edi
call fcn.00534304
add esp, 4
push 0x591ff8
push str._WPS_HOME__
lea ecx, [ebp - 0x10]
call fcn.0045b6e0
push 0x591ff8
push str.__WPS_HOME_
lea ecx, [ebp - 0x10]
call fcn.0045b6e0
push 0x591ff8
push str._WPS_HOME_
lea ecx, [ebp - 0x10]
call fcn.0045b6e0
mov edi, dword [ebp - 0x10]
cmp dword [edi - 0xc], 0
je 0x49001e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
push edi
push ebx
push 0
push str.PATH
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x49002a
push str.PATH
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x490040
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x49006f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x49006f
mov esi, dword [ebp - 0x24]
cmp dword [ebp + 8], 0
jne 0x49042a
lea ecx, [ebp - 0x34]
call fcn.004a7ae0
push 0x104
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.infoGUID
mov byte [ebp - 4], bl
call fcn.00422540
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareKingsoftOffice6.0Common
mov byte [ebp - 4], 3
call fcn.00422540
push 0x80000001
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.004a7d80
push 0x104
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.savedump
call fcn.00422540
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareKingsoftOffice6.0Common
mov byte [ebp - 4], 4
call fcn.00422540
push 0x80000001
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.004a7d80
push 0x104
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.fulldump
call fcn.00422540
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareKingsoftOffice6.0Common
mov byte [ebp - 4], 5
call fcn.00422540
push 0x80000001
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.004a7d80
push 0x104
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.wpsiu
call fcn.00422540
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareKingsoftOffice6.0Common
mov byte [ebp - 4], 6
call fcn.00422540
push 0x80000001
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.004a7d80
push 0x800
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Pushed
call fcn.00422540
mov byte [ebp - 4], 7
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareKingsoftOffice6.0Common
call fcn.00422540
push 0x80000001
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.004a7d80
push 0x104
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x5a5d5c
call fcn.00422540
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
mov byte [ebp - 4], 8
call fcn.00422540
push 0x80000001
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.004a7d80
xor esi, esi
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.snld
call fcn.00422540
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
mov byte [ebp - 4], 9
call fcn.00422540
push 0x80000001
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.004a7d80
push 0x104
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.enable
call fcn.00422540
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareKingsoftOffice6.0Commonhookdnsnew
mov byte [ebp - 4], 0xa
call fcn.00422540
push 0x80000001
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.004a7d80
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.wps_t
call fcn.00422540
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareKingsoftOffice6.0wps
mov byte [ebp - 4], 0xb
call fcn.00422540
push 0x80000001
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.004a7c70
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.et_t
call fcn.00422540
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareKingsoftOffice6.0et
mov byte [ebp - 4], 0xc
call fcn.00422540
push 0x80000001
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.004a7c70
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.wpp_t
call fcn.00422540
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareKingsoftOffice6.0wpp
mov byte [ebp - 4], 0xd
call fcn.00422540
push 0x80000001
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.004a7c70
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.PromeWindowCount
call fcn.00422540
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareKingsoftOffice6.0Common
mov byte [ebp - 4], 0xe
call fcn.00422540
push 0x80000001
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.004a7c70
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.WindowCount
call fcn.00422540
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareKingsoftOffice6.0Common
mov byte [ebp - 4], 0xf
call fcn.00422540
push 0x80000001
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.004a7c70
push 0x2001f
push str.SoftwareKingsoftOffice6.0CommonUserInfo
push 0x80000001
lea ecx, [ebp - 0x24]
call fcn.00438000
test eax, eax
jne 0x49039d
mov ebx, dword [ebp - 0x24]
push str.WhatNewLastCheckDate
push ebx
call edi
push str.WhatNewLastCheckFlag
push ebx
call edi
push 0x5a5c28
push ebx
call edi
cmp ebx, esi
je 0x49039a
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
push 0x2001f
push str.SoftwareKingsoftOffice
push 0x80000001
lea ecx, [ebp - 0x24]
call fcn.00438000
test eax, eax
jne 0x4903d9
push 0x5955c0
lea ecx, [ebp - 0x24]
call fcn.00438290
mov eax, dword [ebp - 0x24]
cmp eax, esi
je 0x4903d6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
push 0x2001f
push str.SoftwareKingsoftOffice
push 0x80000001
lea ecx, [ebp - 0x24]
call fcn.00438000
mov esi, dword [ebp - 0x24]
test eax, eax
jne 0x49041e
push str.languages
push esi
call edi
push str.mui_file_list
push esi
call edi
test esi, esi
je 0x490417
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.004a7af0
test esi, esi
je 0x490435
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret