Function at 0x504ea5
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov eax, 0x56ed5b
call fcn.0053c1d0
sub esp, 0x44c
mov eax, dword [0x5af710]
mov edx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
xor eax, ebp
cmp edx, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push edi
mov dword [ebp - 0x454], edx
mov dword [ebp - 0x458], ebx
je 0x5051de
cmp byte [edx], bl
je 0x5051de
mov byte [ebp - 0x410], bl
xor eax, eax
mov ecx, 0xff
lea edi, [ebp - 0x40f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
lea ecx, [ebp - 0x42c]
stosb byte es:[edi], al
mov dword [ebp - 0x450], 0x3ff
call fcn.00405500
push dword [ebp - 0x454]
lea ecx, [ebp - 0x448]
mov dword [ebp - 4], ebx
call fcn.00405500
lea eax, [ebp - 0x448]
push eax
mov byte [ebp - 4], 1
call fcn.005043ee
pop ecx
push ebx
mov edi, str._CSIDL_WINDOWS_
push edi
lea ecx, [ebp - 0x448]
call fcn.0040b730
cmp eax, ebx
mov dword [ebp - 0x44c], eax
jl 0x504fb7
push dword [ebp - 0x450]
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x410]
push eax
push edi
call fcn.0053be00
pop ecx
push eax
push dword [ebp - 0x44c]
lea ecx, [ebp - 0x42c]
call fcn.0042b102
lea eax, [ebp - 0x42c]
push eax
mov ecx, esi
call fcn.00404830
push ebx
push 1
lea ecx, [ebp - 0x448]
call fcn.00402c50
push ebx
push 1
lea ecx, [ebp - 0x42c]
call fcn.00402c50
jmp 0x5051ea
push ebx
mov edi, str._CSIDL_SYSTEM_
push edi
lea ecx, [ebp - 0x448]
call fcn.0040b730
cmp eax, ebx
mov dword [ebp - 0x44c], eax
jl 0x504fe8
push dword [ebp - 0x450]
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x504f68
push ebx
mov edi, str._CSIDL_PROGRAM_FILES_COMMON_
push edi
lea ecx, [ebp - 0x448]
call fcn.0040b730
cmp eax, ebx
mov dword [ebp - 0x44c], eax
jl 0x505036
push dword [ebp - 0x450]
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x410]
push 0x5c
push eax
call fcn.0053dc90
cmp eax, ebx
pop ecx
pop ecx
je 0x504f68
push str.PROGRAM_FILESCOMMON_FILES
jmp 0x505082
push ebx
mov edi, str._CSIDL_PROGRAM_FILES_
push edi
lea ecx, [ebp - 0x448]
call fcn.0040b730
cmp eax, ebx
mov dword [ebp - 0x44c], eax
jl 0x505098
push dword [ebp - 0x450]
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x410]
push 0x5c
push eax
call fcn.0053dc90
cmp eax, ebx
pop ecx
pop ecx
je 0x504f68
push str.PROGRAM_FILES
mov byte [eax + 1], bl
lea eax, [ebp - 0x410]
push eax
call fcn.0053c4c0
pop ecx
pop ecx
jmp 0x504f68
push ebx
mov edi, str._WINDIR_
push edi
lea ecx, [ebp - 0x448]
call fcn.0040b730
cmp eax, ebx
mov dword [ebp - 0x44c], eax
jge 0x504f55
push ebx
push str._MSOFFICEXP_
lea ecx, [ebp - 0x448]
call fcn.0040b730
mov edi, eax
cmp edi, ebx
jl 0x505159
lea eax, [ebp - 0x44c]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftOffice10.0CommonInstallRoot
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x505148
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x410]
push eax
push ebx
push ebx
push str.Path
push dword [ebp - 0x44c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x44c]
mov dword [ebp - 0x454], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x454], ebx
jne 0x505148
lea eax, [ebp - 0x410]
push eax
push str._MSOFFICE2003_
call fcn.0053be00
pop ecx
push eax
push edi
jmp 0x504f7d
push 0x572aed
mov ecx, esi
call fcn.00405500
jmp 0x504f96
push ebx
mov edi, str._MSOFFICE2003_
push edi
lea ecx, [ebp - 0x448]
call fcn.0040b730
cmp eax, ebx
mov dword [ebp - 0x44c], eax
jl 0x504f88
lea eax, [ebp - 0x454]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftOffice11.0CommonInstallRoot
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x505148
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x410]
push eax
push ebx
push ebx
push str.Path
push dword [ebp - 0x454]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x454]
mov dword [ebp - 0x458], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x458], ebx
jne 0x505148
jmp 0x504f68
push 0x572aed
mov ecx, esi
call fcn.00405500
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053aaae
leave
ret