Function at 0x40cd40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4989d1
mov eax, dword fs:[0]
push eax
sub esp, 0xc24
mov eax, dword [0x4cb070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor bh, bh
xor bl, bl
cmp dword [esi + 0x14], 8
jb 0x40cd7f
mov eax, dword [esi]
jmp 0x40cd81
mov eax, esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
call edi
push str..doc
push eax
call fcn.0047b80b
add esp, 8
test eax, eax
je 0x40cf7c
cmp dword [esi + 0x14], 8
jb 0x40cdaa
mov eax, dword [esi]
jmp 0x40cdac
mov eax, esi
push eax
call edi
push str..docx
push eax
call fcn.0047b80b
add esp, 8
test eax, eax
je 0x40cf7c
cmp dword [esi + 0x14], 8
jb 0x40cdcf
mov eax, dword [esi]
jmp 0x40cdd1
mov eax, esi
push eax
call edi
push str..docm
push eax
call fcn.0047b80b
add esp, 8
test eax, eax
je 0x40cf7c
cmp dword [esi + 0x14], 8
jb 0x40cdf4
mov eax, dword [esi]
jmp 0x40cdf6
mov eax, esi
push eax
call edi
push str..txt
push eax
call fcn.0047b80b
add esp, 8
test eax, eax
je 0x40cf7c
cmp dword [esi + 0x14], 8
jb 0x40ce19
mov eax, dword [esi]
jmp 0x40ce1b
mov eax, esi
push eax
call edi
push str..dot
push eax
call fcn.0047b80b
add esp, 8
test eax, eax
je 0x40cf7c
cmp dword [esi + 0x14], 8
jb 0x40ce3e
mov eax, dword [esi]
jmp 0x40ce40
mov eax, esi
push eax
call edi
push str..dotm
push eax
call fcn.0047b80b
add esp, 8
test eax, eax
je 0x40cf7c
cmp dword [esi + 0x14], 8
jb 0x40ce63
mov ecx, dword [esi]
jmp 0x40ce65
mov ecx, esi
mov edx, str..dotx
call fcn.004422a0
test al, al
jne 0x40cf7c
cmp dword [esi + 0x14], 8
jb 0x40ce81
mov ecx, dword [esi]
jmp 0x40ce83
mov ecx, esi
mov edx, str..rtf
call fcn.004422a0
test al, al
jne 0x40cf7c
cmp dword [esi + 0x14], 8
jb 0x40ce9f
mov ecx, dword [esi]
jmp 0x40cea1
mov ecx, esi
mov edx, str..wps
call fcn.004422a0
test al, al
jne 0x40cf7c
cmp dword [esi + 0x14], 8
jb 0x40cebd
mov ecx, dword [esi]
jmp 0x40cebf
mov ecx, esi
mov edx, str..ppt
call fcn.004422a0
test al, al
jne 0x40cf78
cmp dword [esi + 0x14], 8
jb 0x40cedb
mov ecx, dword [esi]
jmp 0x40cedd
mov ecx, esi
mov edx, str..pptx
call fcn.004422a0
test al, al
jne 0x40cf78
cmp dword [esi + 0x14], 8
jb 0x40cef9
mov ecx, dword [esi]
jmp 0x40cefb
mov ecx, esi
mov edx, str..pptm
call fcn.004422a0
test al, al
jne 0x40cf78
cmp dword [esi + 0x14], 8
jb 0x40cf13
mov ecx, dword [esi]
jmp 0x40cf15
mov ecx, esi
mov edx, str..ppsx
call fcn.004422a0
test al, al
jne 0x40cf78
cmp dword [esi + 0x14], 8
jb 0x40cf2d
mov ecx, dword [esi]
jmp 0x40cf2f
mov ecx, esi
mov edx, str..pps
call fcn.004422a0
test al, al
jne 0x40cf78
cmp dword [esi + 0x14], 8
jb 0x40cf47
mov ecx, dword [esi]
jmp 0x40cf49
mov ecx, esi
mov edx, str..ppsm
call fcn.004422a0
test al, al
jne 0x40cf78
cmp dword [esi + 0x14], 8
jb 0x40cf61
mov ecx, dword [esi]
jmp 0x40cf63
mov ecx, esi
mov edx, str..odp
call fcn.004422a0
test al, al
jne 0x40cf78
xor al, al
jmp 0x40d1c1
mov bl, 1
jmp 0x40cf7e
mov bh, 1
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00474730
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0xc24]
add esp, 0xc
mov dword [ebp - 0xc28], 1
mov dword [ebp - 0xc24], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xc28]
push eax
push str.Path
push str.SOFTWAREMicrosoftoffice16.0CommonInstallRoot
push closesocket
call edi
test eax, eax
je 0x40d0e8
lea eax, [ebp - 0xc24]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xc28]
push eax
push str.Path
push str.SOFTWAREMicrosoftoffice15.0CommonInstallRoot
push closesocket
call edi
test eax, eax
je 0x40d0e8
lea eax, [ebp - 0xc24]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xc28]
push eax
push str.Path
push str.SOFTWAREMicrosoftoffice14.0CommonInstallRoot
push closesocket
call edi
test eax, eax
je 0x40d0e8
lea eax, [ebp - 0xc24]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xc28]
push eax
push str.Path
push str.SOFTWAREMicrosoftoffice12.0CommonInstallRoot
push closesocket
call edi
test eax, eax
je 0x40d0e8
lea eax, [ebp - 0xc24]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xc28]
push eax
push str.Path
push str.SOFTWAREMicrosoftoffice11.0CommonInstallRoot
push closesocket
call edi
test eax, eax
je 0x40d0e8
lea eax, [ebp - 0xc24]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xc28]
push eax
push str.Path
push str.SOFTWAREMicrosoftoffice10.0CommonInstallRoot
push closesocket
call edi
test eax, eax
je 0x40d0e8
lea eax, [ebp - 0xc24]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xc28]
push eax
push str.Path
push str.SOFTWAREMicrosoftoffice9.0CommonInstallRoot
push closesocket
call edi
test eax, eax
jne 0x40cf71
test bh, bh
je 0x40d11c
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push str._sWINWORD.EXE
push eax
call fcn.0040e590
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x40d10f
mov esi, dword [esi]
push 0x4aed50
push esi
push str._j___s____s_
jmp 0x40d14e
test bl, bl
je 0x40d15d
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push str._sPOWERPNT.EXE
push eax
call fcn.0040e590
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x40d143
mov esi, dword [esi]
push esi
push 0x4aed50
push str._pt___s____s_
lea eax, [ebp - 0xc20]
push eax
call fcn.0040e590
add esp, 0x10
lea ecx, [ebp - 0xc30]
call fcn.004456e0
sub esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 0xc20]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00445c50
test eax, eax
sete bl
mov dword [ebp - 4], 1
mov esi, dword [ebp - 0xc2c]
test esi, esi
je 0x40d1bc
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x40d1bc
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x40d1bc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
test bl, bl
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00459a5d
mov esp, ebp
pop ebp
ret 4