Function at 0x4a8bd0
Capabilities:
Delete registry value
Link many functions at runtime
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e598
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x62819c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
lea eax, [ebp - 0x24]
mov dword [ebp - 4], ebx
push eax
push 0x2001f
push ebx
push 0x5ac698
push 0x80000000
mov dword [ebp - 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4a8ce4
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x30]
push str..uof
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ebx
call fcn.004395c0
push str..uop
lea ecx, [ebp - 0x30]
call fcn.004395c0
push str..uos
lea ecx, [ebp - 0x30]
call fcn.004395c0
push str..uot
lea ecx, [ebp - 0x30]
call fcn.004395c0
push str.ksotheme
lea ecx, [ebp - 0x30]
call fcn.004395c0
push str.WPSSkin.WPSSkinAddin
lea ecx, [ebp - 0x30]
call fcn.004395c0
push 0x5b02d0
lea ecx, [ebp - 0x30]
call fcn.004395c0
push str.Wps_auto_file
lea ecx, [ebp - 0x30]
call fcn.004395c0
push str.Wpsdoc.wpsdoc
lea ecx, [ebp - 0x30]
call fcn.004395c0
push str.Et_auto_file
lea ecx, [ebp - 0x30]
call fcn.004395c0
push str.Uof_auto_file
lea ecx, [ebp - 0x30]
call fcn.004395c0
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4a8cda
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x14], 0
test ebx, ebx
je 0x4a8d44
cmp dword [ebx], 0
je 0x4a8d37
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4a8d0a
mov eax, 1
jmp 0x4a8d60
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a8d3d
push 0
push dword [ebx]
lea ecx, [ebp - 0x14]
push ecx
push 0x2001f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000001
call eax
jmp 0x4a8d60
cmp dword [ebx + 4], 0
jne 0x4a8d44
mov eax, 1
jmp 0x4a8d60
lea eax, [ebp - 0x14]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x2001f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000001
call eax
test eax, eax
jne 0x4a8da2
test edi, edi
je 0x4a8d6b
push edi
call esi
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4a8da2
push 0x5b0368
lea ecx, [ebp - 0x30]
call fcn.004395c0
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4a8d98
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
xor esi, esi
mov dword [ebp - 0x10], esi
test ebx, ebx
je 0x4a8e06
cmp dword [ebx], esi
je 0x4a8dfa
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4a8dc3
lea eax, [esi + 1]
jmp 0x4a8e21
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a8df0
push 0
push dword [ebx]
lea ecx, [ebp - 0x10]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0Common
push 0x80000001
call eax
jmp 0x4a8e21
mov esi, dword [ebp - 0x10]
mov eax, 1
jmp 0x4a8e24
cmp dword [ebx + 4], esi
jne 0x4a8e06
mov eax, 1
jmp 0x4a8e24
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0Common
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x4a8edb
test edi, edi
je 0x4a8e3a
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x2c], 0
mov edi, esi
mov dword [ebp - 0x30], edi
test eax, eax
jne 0x4a8edb
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.Version
push esi
call ebx
push str.PersonalVersionNumber
push esi
call ebx
push str.ProfessionVersionNumber
push esi
call ebx
push str.InstallRoot
push esi
call ebx
push str.DisplayName
push esi
call ebx
push str.DistSrc
push esi
call ebx
push str.DefaultLanguage
push esi
call ebx
push str.hostprocname
push esi
call ebx
push str.category
push esi
call ebx
push str.newGuideShow
push esi
call ebx
push str.Theme
lea ecx, [ebp - 0x30]
call fcn.004395c0
push str.plgpf
lea ecx, [ebp - 0x30]
call fcn.004395c0
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4a8ed1
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x18], 0
test ebx, ebx
je 0x4a8f3b
cmp dword [ebx], 0
je 0x4a8f2e
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4a8f01
mov eax, 1
jmp 0x4a8f56
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a8f34
push 0
push dword [ebx]
lea ecx, [ebp - 0x18]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
push 0x80000001
call eax
jmp 0x4a8f56
cmp dword [ebx + 4], 0
jne 0x4a8f3b
mov eax, 1
jmp 0x4a8f56
lea eax, [ebp - 0x18]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a8f97
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4a8f67
push edi
call esi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4a8f97
push str.qald
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4a8f90
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
test ebx, ebx
je 0x4a8ff7
cmp dword [ebx], 0
je 0x4a8fea
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4a8fbd
mov eax, 1
jmp 0x4a9012
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a8ff0
push 0
push dword [ebx]
lea ecx, [ebp - 0x1c]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0Commonupdateinfo
push 0x80000001
call eax
jmp 0x4a9012
cmp dword [ebx + 4], 0
jne 0x4a8ff7
mov eax, 1
jmp 0x4a9012
lea eax, [ebp - 0x1c]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0Commonupdateinfo
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a905a
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4a9023
push edi
call esi
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4a905a
push str.cacheStatusInfo
lea ecx, [ebp - 0x30]
call fcn.004395c0
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4a9050
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov esi, dword [str.SoftwarekingsoftOffice6.0Commonupdateinfo]
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4a90bc
cmp dword [ebx], 0
je 0x4a90af
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4a9086
mov eax, 1
jmp 0x4a90d3
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a90b5
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push esi
push 0x80000001
call eax
jmp 0x4a90d3
cmp dword [ebx + 4], 0
jne 0x4a90bc
mov eax, 1
jmp 0x4a90d3
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a9114
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4a90e4
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4a9114
push str.diffcheckerror
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4a910d
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4a9174
cmp dword [ebx], 0
je 0x4a9167
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4a913a
mov eax, 1
jmp 0x4a918f
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a916d
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0etApplication_Settings
push 0x80000001
call eax
jmp 0x4a918f
cmp dword [ebx + 4], 0
jne 0x4a9174
mov eax, 1
jmp 0x4a918f
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0etApplication_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a91d0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4a91a0
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4a91d0
push str.RestartAppInfo
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4a91c9
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4a9230
cmp dword [ebx], 0
je 0x4a9223
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4a91f6
mov eax, 1
jmp 0x4a924b
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a9229
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wpsApplication_Settings
push 0x80000001
call eax
jmp 0x4a924b
cmp dword [ebx + 4], 0
jne 0x4a9230
mov eax, 1
jmp 0x4a924b
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wpsApplication_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a928c
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4a925c
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4a928c
push str.RestartAppInfo
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4a9285
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4a92ec
cmp dword [ebx], 0
je 0x4a92df
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4a92b2
mov eax, 1
jmp 0x4a9307
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a92e5
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wppApplication_Settings
push 0x80000001
call eax
jmp 0x4a9307
cmp dword [ebx + 4], 0
jne 0x4a92ec
mov eax, 1
jmp 0x4a9307
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wppApplication_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a9348
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4a9318
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4a9348
push str.RestartAppInfo
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4a9341
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4a93a8
cmp dword [ebx], 0
je 0x4a939b
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4a936e
mov eax, 1
jmp 0x4a93c3
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a93a1
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wpsofficeApplication_Settings
push 0x80000001
call eax
jmp 0x4a93c3
cmp dword [ebx + 4], 0
jne 0x4a93a8
mov eax, 1
jmp 0x4a93c3
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0wpsofficeApplication_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a9404
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4a93d4
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4a9404
push str.AppComponentMode
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4a93fd
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4a9464
cmp dword [ebx], 0
je 0x4a9457
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4a942a
mov eax, 1
jmp 0x4a947f
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a945d
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0pluginskstartpage
push 0x80000001
call eax
jmp 0x4a947f
cmp dword [ebx + 4], 0
jne 0x4a9464
mov eax, 1
jmp 0x4a947f
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwarekingsoftOffice6.0pluginskstartpage
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a94d4
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4a9490
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4a94d4
push str.searchRecord
lea ecx, [ebp - 0x30]
call fcn.004395c0
push str.searchRecord2
lea ecx, [ebp - 0x30]
call fcn.004395c0
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4a94ca
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x10], 0
test ebx, ebx
je 0x4a9534
cmp dword [ebx], 0
je 0x4a9527
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4a94fa
mov eax, 1
jmp 0x4a954f
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a952d
push 0
push dword [ebx]
lea ecx, [ebp - 0x10]
push ecx
push 0x2001f
push 0
push str.Environment
push 0x80000001
call eax
jmp 0x4a954f
cmp dword [ebx + 4], 0
jne 0x4a9534
mov eax, 1
jmp 0x4a954f
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
push str.Environment
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a9730
test edi, edi
je 0x4a9562
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4a9730
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa454
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
push str.WPS_HOME
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x208
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push str.PATH
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a96fa
mov eax, dword [ebp - 0x20]
cmp eax, 1
je 0x4a95d9
cmp eax, 2
jne 0x4a96fa
mov eax, dword [ebp - 0x24]
shr eax, 1
mov dword [ebp - 0x24], eax
je 0x4a96fa
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00546052
mov ecx, dword [ebp - 0x24]
add esp, 4
mov esi, eax
add ecx, ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ecx
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push 0
push str.PATH
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a9646
mov eax, dword [ebp - 0x20]
cmp eax, 1
je 0x4a9637
cmp eax, 2
jne 0x4a9646
test esi, esi
je 0x4a964a
cmp dword [ebp - 0x24], 0
jne 0x4a9646
xor eax, eax
mov word [esi], ax
test esi, esi
jne 0x4a964e
xor ecx, ecx
jmp 0x4a9662
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a9653
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x14]
call fcn.00429240
push esi
call fcn.0054605b
add esp, 4
lea ecx, [ebp - 0x14]
push 0x5ac698
push str._WPS_HOME__
call fcn.0045f8f0
push 0x5ac698
push str.__WPS_HOME_
lea ecx, [ebp - 0x14]
call fcn.0045f8f0
push 0x5ac698
push str._WPS_HOME_
lea ecx, [ebp - 0x14]
call fcn.0045f8f0
mov esi, dword [ebp - 0x14]
cmp dword [esi - 0xc], 0
je 0x4a96ec
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a96c0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 2
push 0
push str.PATH
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4a96fa
push str.PATH
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4a970d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4a9730
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp + 8], 0
jne 0x4aa437
lea ecx, [ebp - 0x3c]
call fcn.004c8f90
push 0x104
push ecx
mov esi, esp
mov byte [ebp - 4], 2
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa454
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.infoGUID
mov byte [ebp - 4], 3
mov ecx, esi
test eax, 0xffff0000
jne 0x4a978a
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a9796
push 8
push str.infoGUID
call fcn.00429870
push ecx
mov esi, esp
mov byte [ebp - 4], 4
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa45e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0Common
mov byte [ebp - 4], 5
shr eax, 0x10
mov ecx, str.SoftwareKingsoftOffice6.0Common
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4a97de
movzx eax, cx
mov ecx, esi
push eax
call fcn.004295b0
jmp 0x4a97ec
push 0x23
push str.SoftwareKingsoftOffice6.0Common
mov ecx, esi
call fcn.00429870
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004c9320
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa454
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.savedump
mov byte [ebp - 4], 6
mov ecx, esi
test eax, 0xffff0000
jne 0x4a9845
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a9851
push 8
push str.savedump
call fcn.00429870
push ecx
mov esi, esp
mov byte [ebp - 4], 7
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa468
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 8
jne 0x4a9890
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a989c
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.00429870
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004c9320
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa454
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.fulldump
mov byte [ebp - 4], 9
mov ecx, esi
test eax, 0xffff0000
jne 0x4a98f5
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a9901
push 8
push str.fulldump
call fcn.00429870
push ecx
mov esi, esp
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa472
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0xb
jne 0x4a9940
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a994c
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.00429870
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004c9320
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa454
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.wpsiu
mov byte [ebp - 4], 0xc
mov ecx, esi
test eax, 0xffff0000
jne 0x4a99a5
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a99b1
push 5
push str.wpsiu
call fcn.00429870
push ecx
mov esi, esp
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa47c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0xe
jne 0x4a99f0
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a99fc
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.00429870
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004c9320
push 0x800
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa454
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.Pushed
mov byte [ebp - 4], 0xf
mov ecx, esi
test eax, 0xffff0000
jne 0x4a9a55
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a9a61
push 6
push str.Pushed
call fcn.00429870
push ecx
mov esi, esp
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa486
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0x11
jne 0x4a9aa0
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a9aac
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.00429870
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004c9320
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x24], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa454
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, 0x5b06b4
mov byte [ebp - 4], 0x12
mov ecx, esi
test eax, 0xffff0000
jne 0x4a9b05
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a9b11
push 3
push 0x5b06b4
call fcn.00429870
push ecx
mov esi, esp
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x1c], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa490
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0CommonAuthInfo
mov byte [ebp - 4], 0x14
shr eax, 0x10
mov ecx, str.SoftwareKingsoftOffice6.0CommonAuthInfo
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x4a9b59
movzx eax, cx
mov ecx, esi
push eax
call fcn.004295b0
jmp 0x4a9b67
push 0x2c
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
mov ecx, esi
call fcn.00429870
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004c9320
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x1c], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa454
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.fldLength
mov byte [ebp - 4], 0x15
mov ecx, esi
test eax, 0xffff0000
jne 0x4a9bc0
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a9bcc
push 9
push str.fldLength
call fcn.00429870
push ecx
mov esi, esp
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x1c], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa49a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x24], 0
mov ecx, esi
mov byte [ebp - 4], 0x17
jne 0x4a9c0b
mov eax, str.SoftwareKingsoftOffice6.0CommonAuthInfo
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a9c17
push 0x2c
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
call fcn.00429870
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004c9320
push 0
push ecx
mov esi, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x1c], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa454
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.snld
mov byte [ebp - 4], 0x18
mov ecx, esi
test eax, 0xffff0000
jne 0x4a9c6d
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a9c79
push 4
push str.snld
call fcn.00429870
push ecx
mov esi, esp
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x1c], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa4a4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x24], 0
mov ecx, esi
mov byte [ebp - 4], 0x1a
jne 0x4a9cb8
mov eax, str.SoftwareKingsoftOffice6.0CommonAuthInfo
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a9cc4
push 0x2c
push str.SoftwareKingsoftOffice6.0CommonAuthInfo
call fcn.00429870
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004c9320
push 0x104
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa454
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.enable
mov byte [ebp - 4], 0x1b
mov ecx, esi
test eax, 0xffff0000
jne 0x4a9d1d
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a9d29
push 6
push str.enable
call fcn.00429870
push ecx
mov esi, esp
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa4ae
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0Commonhookdnsnew
mov byte [ebp - 4], 0x1d
mov ecx, esi
test eax, 0xffff0000
jne 0x4a9d69
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a9d75
push 0x2e
push str.SoftwareKingsoftOffice6.0Commonhookdnsnew
call fcn.00429870
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004c9320
push 0xffffffffffffffff
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa454
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.wps_t
mov byte [ebp - 4], 0x1e
mov ecx, esi
test eax, 0xffff0000
jne 0x4a9dcb
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a9dd7
push 5
push str.wps_t
call fcn.00429870
push ecx
mov esi, esp
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa4b8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0wps
mov byte [ebp - 4], 0x20
mov ecx, esi
test eax, 0xffff0000
jne 0x4a9e17
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a9e23
push 0x20
push str.SoftwareKingsoftOffice6.0wps
call fcn.00429870
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004c9190
push 0xffffffffffffffff
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa454
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.et_t
mov byte [ebp - 4], 0x21
mov ecx, esi
test eax, 0xffff0000
jne 0x4a9e79
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a9e85
push 4
push str.et_t
call fcn.00429870
push ecx
mov esi, esp
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa4c2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0et
mov byte [ebp - 4], 0x23
mov ecx, esi
test eax, 0xffff0000
jne 0x4a9ec5
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a9ed1
push 0x1f
push str.SoftwareKingsoftOffice6.0et
call fcn.00429870
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004c9190
push 0xffffffffffffffff
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa454
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.wpp_t
mov byte [ebp - 4], 0x24
mov ecx, esi
test eax, 0xffff0000
jne 0x4a9f27
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a9f33
push 5
push str.wpp_t
call fcn.00429870
push ecx
mov esi, esp
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa4cc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SoftwareKingsoftOffice6.0wpp
mov byte [ebp - 4], 0x26
mov ecx, esi
test eax, 0xffff0000
jne 0x4a9f73
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a9f7f
push 0x20
push str.SoftwareKingsoftOffice6.0wpp
call fcn.00429870
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004c9190
push 0
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa454
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.PromeWindowCount
mov byte [ebp - 4], 0x27
mov ecx, esi
test eax, 0xffff0000
jne 0x4a9fd5
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4a9fe1
push 0x10
push str.PromeWindowCount
call fcn.00429870
push ecx
mov esi, esp
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa4d6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0x29
jne 0x4aa020
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4aa02c
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.00429870
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004c9190
push 0
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa454
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.WindowCount
mov byte [ebp - 4], 0x2a
mov ecx, esi
test eax, 0xffff0000
jne 0x4aa082
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4aa08e
push 0xb
push str.WindowCount
call fcn.00429870
push ecx
mov esi, esp
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0x20], esi
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4aa4e0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp - 0x10], 0
mov ecx, esi
mov byte [ebp - 4], 0x2c
jne 0x4aa0cd
mov eax, str.SoftwareKingsoftOffice6.0Common
movzx eax, ax
push eax
call fcn.004295b0
jmp 0x4aa0d9
push 0x23
push str.SoftwareKingsoftOffice6.0Common
call fcn.00429870
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x3c]
push 0x80000001
mov byte [ebp - 4], 2
call fcn.004c9190
xor esi, esi
mov dword [ebp - 0x10], esi
test ebx, ebx
je 0x4aa152
cmp dword [ebx], esi
je 0x4aa146
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4aa10f
lea eax, [esi + 1]
jmp 0x4aa16d
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4aa13c
push 0
push dword [ebx]
lea ecx, [ebp - 0x10]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0CommonUserInfo
push 0x80000001
call eax
jmp 0x4aa16d
mov esi, dword [ebp - 0x10]
mov eax, 1
jmp 0x4aa170
cmp dword [ebx + 4], esi
jne 0x4aa152
mov eax, 1
jmp 0x4aa170
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOffice6.0CommonUserInfo
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x4aa1cd
test edi, edi
je 0x4aa182
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x2c], 0
mov edi, esi
mov dword [ebp - 0x30], edi
test eax, eax
jne 0x4aa1cd
push str.WhatNewLastCheckDate
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.WhatNewLastCheckFlag
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.WhatNewVersion
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x4aa1c6
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4aa22d
cmp dword [ebx], 0
je 0x4aa220
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4aa1f3
mov eax, 1
jmp 0x4aa248
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4aa226
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOffice
push 0x80000001
call eax
jmp 0x4aa248
cmp dword [ebx + 4], 0
jne 0x4aa22d
mov eax, 1
jmp 0x4aa248
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOffice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4aa2b1
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4aa259
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4aa2b1
mov ecx, 0x6319b8
call fcn.0048d4f0
test eax, eax
setne bl
test eax, eax
je 0x4aa282
call fcn.00531c70
push 0x5b0360
lea ecx, [ebp - 0x30]
call fcn.004395c0
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4aa29e
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test bl, bl
je 0x4aa2ae
call fcn.0052b570
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4aa311
cmp dword [ebx], 0
je 0x4aa304
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4aa2d7
mov eax, 1
jmp 0x4aa32c
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4aa30a
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOffice
push 0x80000001
call eax
jmp 0x4aa32c
cmp dword [ebx + 4], 0
jne 0x4aa311
mov eax, 1
jmp 0x4aa32c
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOffice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4aa379
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4aa33d
push edi
call esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4aa379
push 0x5b0750
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.mui_file_list
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x4aa372
push edi
call esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x4aa3d9
cmp dword [ebx], 0
je 0x4aa3cc
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4aa39f
mov eax, 1
jmp 0x4aa3f4
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4aa3d2
push 0
push dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
push str.SoftwareKingsoftOfficeWPS
push 0x80000001
call eax
jmp 0x4aa3f4
cmp dword [ebx + 4], 0
jne 0x4aa3d9
mov eax, 1
jmp 0x4aa3f4
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push 0
push str.SoftwareKingsoftOfficeWPS
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4aa42f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4aa405
push edi
call ebx
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
test eax, eax
jne 0x4aa42f
push str.AddinsLF
lea ecx, [ebp - 0x30]
call fcn.004395c0
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x4aa42f
push edi
call ebx
xor edi, edi
lea ecx, [ebp - 0x3c]
call fcn.004c9090
test edi, edi
je 0x4aa442
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
int3