Function at 0x10007432
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
mov eax, dword [0x1005f070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x830], edi
mov dword [ebp - 0x840], eax
test edi, edi
je 0x100077c3
test eax, eax
je 0x100077c3
cmp dword [ebp + 0xc], 0
je 0x100077c3
test esi, esi
je 0x10007486
and dword [esi], 0
xor eax, eax
mov word [ebp - 0x210], ax
xor al, al
test byte [ebp + 0xc], 1
mov byte [ebp - 0x829], al
je 0x10007590
push edi
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
je 0x1000757c
push 0
push edi
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
mov edi, eax
test edi, edi
je 0x100074ec
push edi
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
cmp eax, 0xffffffff
je 0x100074e6
mov edx, dword [edi + 0xc]
test edx, edx
je 0x100074e6
push 0x104
lea ecx, [ebp - 0x210]
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
mov byte [ebp - 0x829], 1
push edi
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test byte [ebp + 0xc], 4
je 0x10007584
cmp byte [ebp - 0x829], 0
je 0x10007565
push ecx
lea eax, [ebp - 0x828]
mov edx, 0x100348e8
push eax
push ecx
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
je 0x1000752b
lea edx, [ebp - 0x828]
lea ecx, [ebp - 0x210]
call fcn.1000d8bb
test eax, eax
jne 0x10007557
push ecx
lea eax, [ebp - 0x828]
mov edx, str..mht
push eax
push ecx
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
je 0x1000755b
lea edx, [ebp - 0x828]
lea ecx, [ebp - 0x210]
call fcn.1000d8bb
test eax, eax
je 0x1000755b
xor al, al
jmp 0x10007561
mov al, byte [ebp - 0x829]
test al, al
jne 0x1000758a
test esi, esi
je 0x1000756f
mov dword [esi], 1
xor eax, eax
mov word [ebp - 0x210], ax
mov al, 1
jmp 0x1000758a
mov al, byte [ebp - 0x829]
jmp 0x10007590
mov al, byte [ebp - 0x829]
mov edi, dword [ebp - 0x830]
test byte [ebp + 0xc], 2
je 0x10007657
test al, al
jne 0x10007657
push 0x2e
pop edx
mov ecx, edi
call fcn.1000d7ca
and dword [ebp - 0x830], 0
lea ecx, [ebp - 0x830]
push ecx
push 0x20019
push ecx
mov edx, eax
mov ecx, 0x80000000
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
jne 0x10007642
movzx eax, byte [ebp - 0x418]
xor ecx, ecx
cmp dword [ebp - 0x834], 1
mov dword [ebp - 0x83c], 0x208
cmove eax, ecx
mov byte [ebp - 0x418], al
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x834]
push eax
push ecx
push ecx
push dword [ebp - 0x830]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x10007642
cmp dword [ebp - 0x834], 1
jne 0x10007642
cmp word [ebp - 0x418], ax
je 0x10007642
push 0x105
lea edx, [ebp - 0x418]
lea ecx, [ebp - 0x210]
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
cmp dword [ebp - 0x830], 0
je 0x10007657
push dword [ebp - 0x830]
call dword [sym.imp.advapi32.dll_RegCloseKey]
test byte [ebp + 0xc], 8
je 0x100076a3
mov eax, dword [str.PowerPoint.Show]
xor esi, esi
jmp 0x1000767f
lea edx, [ebp - 0x210]
mov ecx, eax
call fcn.1000d8bb
test eax, eax
jne 0x10007685
mov eax, dword [esi*8 + 0x10037438]
inc esi
test eax, eax
jne 0x10007666
jmp 0x100076a3
imul edx, dword [esi*8 + 0x10037434], 0x30
lea ecx, [ebp - 0x210]
push 0x105
mov edx, dword [edx + 0x100375b8]
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
and dword [ebp - 0x838], 0
lea eax, [ebp - 0x838]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x210]
mov ecx, 0x80000000
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
jne 0x1000777d
and dword [ebp - 0x830], eax
mov edx, str.CurVer
lea eax, [ebp - 0x830]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x838]
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
jne 0x10007768
movzx eax, byte [ebp - 0x620]
xor ecx, ecx
cmp dword [ebp - 0x834], 1
mov dword [ebp - 0x83c], 0x208
cmove eax, ecx
mov byte [ebp - 0x620], al
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x834]
push eax
push ecx
push ecx
push dword [ebp - 0x830]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x10007768
cmp dword [ebp - 0x834], 1
jne 0x10007768
cmp word [ebp - 0x620], ax
je 0x10007768
push 0x105
lea edx, [ebp - 0x620]
lea ecx, [ebp - 0x210]
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
cmp dword [ebp - 0x830], 0
je 0x1000777d
push dword [ebp - 0x830]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [ebp - 0x844]
mov esi, dword [ebp - 0x840]
test eax, eax
je 0x1000779c
push dword [esi]
lea edx, [ebp - 0x210]
mov ecx, eax
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
lea ecx, [ebp - 0x210]
call fcn.1000d787
cmp dword [ebp - 0x838], 0
mov dword [esi], eax
je 0x100077be
push dword [ebp - 0x838]
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x100077c5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1002f764
leave
ret 0x14