Function at 0x409df0
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440635
mov eax, dword fs:[0]
push eax
mov eax, 0x1544
call fcn.0043a3c0
mov eax, dword [0x450398]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x1514]
push eax
mov ecx, 0x4498c4
call fcn.00413b80
mov edx, dword [ebp - 0x1514]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x1518]
push ecx
push 0xf013f
push 0
push edx
push 0x80000000
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x409e98
mov eax, dword [ebp - 0x1518]
push str.EmOfficeAddIn.Connect
push eax
call edi
mov ecx, dword [ebp - 0x1518]
push str.EmExcelBLL.UI.UserControls.EmLeftCustomPanel
push ecx
call edi
mov edx, dword [ebp - 0x1518]
push str.EM.RTQ
push edx
call edi
mov eax, dword [ebp - 0x1518]
push eax
call ebx
mov eax, dword [ebp - 0x1514]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409eba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x1514]
push ecx
mov ecx, 0x4498b8
call fcn.00413b80
mov eax, dword [ebp - 0x1514]
lea edx, [ebp - 0x1518]
push edx
push 0xf013f
push 0
push eax
push 0x80000000
call esi
test eax, eax
jne 0x409f1e
mov ecx, dword [ebp - 0x1518]
push str.7EBF1CFE_F86C_429C_ADA4_9E95D48ACCC8
push ecx
call edi
mov edx, dword [ebp - 0x1518]
push str.9FC070A9_4E12_472C_A889_6BA2A7209975
push edx
call edi
mov eax, dword [ebp - 0x1518]
push str.EBD9B4A9_3E17_45F0_A1C9_E134043923D3
push eax
call edi
mov ecx, dword [ebp - 0x1518]
push ecx
call ebx
mov eax, dword [ebp - 0x1514]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409f40
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x1514]
push ecx
mov ecx, str.Wow6432NodeCLSID
call fcn.00413b80
mov eax, dword [ebp - 0x1514]
lea edx, [ebp - 0x1518]
push edx
push 0xf013f
push 0
push eax
push 0x80000000
call esi
test eax, eax
jne 0x409fa4
mov ecx, dword [ebp - 0x1518]
push str.7EBF1CFE_F86C_429C_ADA4_9E95D48ACCC8
push ecx
call edi
mov edx, dword [ebp - 0x1518]
push str.9FC070A9_4E12_472C_A889_6BA2A7209975
push edx
call edi
mov eax, dword [ebp - 0x1518]
push str.EBD9B4A9_3E17_45F0_A1C9_E134043923D3
push eax
call edi
mov ecx, dword [ebp - 0x1518]
push ecx
call ebx
mov eax, dword [ebp - 0x1514]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409fc6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0xd0e]
push edx
mov word [ebp - 0xd10], cx
call fcn.00429770
add esp, 0xc
lea ecx, [ebp - 0xd10]
call fcn.00401e30
lea eax, [ebp - 0x1520]
push eax
lea ecx, [ebp - 0xd10]
call fcn.00413b80
lea ecx, [ebp - 0x1520]
push ecx
lea edx, [ebp - 0x1514]
push edx
mov ebx, 0x4474e0
mov dword [ebp - 4], 0
call fcn.004141a0
mov ecx, dword [ebp - 0x1514]
add esp, 8
lea eax, [ebp - 0x1518]
push eax
push 0xf003f
push 0
push ecx
push 0x80000003
call esi
test eax, eax
jne 0x40a062
mov edx, dword [ebp - 0x1518]
push str.EmOfficeAddIn.Connect
push edx
call edi
mov eax, dword [ebp - 0x1518]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebx
jmp 0x40a068
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1514]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a08a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1520]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a0b3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x1514]
push ecx
mov ecx, str.SoftwareMicrosoftOfficeExcelAddins
call fcn.00413b80
mov eax, dword [ebp - 0x1514]
lea edx, [ebp - 0x1518]
push edx
push 0xf013f
push 0
push eax
push 0x80000002
call esi
test eax, eax
jne 0x40a0fb
mov ecx, dword [ebp - 0x1518]
push str.EmOfficeAddIn.Connect
push ecx
call edi
mov edx, dword [ebp - 0x1518]
push edx
call ebx
mov eax, dword [ebp - 0x1514]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a11d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x1514]
push ecx
mov ecx, str.SoftwareWow6432NodeMicrosoftOfficeExcelAddins
call fcn.00413b80
mov eax, dword [ebp - 0x1514]
lea edx, [ebp - 0x1518]
push edx
push 0xf013f
push 0
push eax
push 0x80000002
call esi
test eax, eax
jne 0x40a165
mov ecx, dword [ebp - 0x1518]
push str.EmOfficeAddIn.Connect
push ecx
call edi
mov edx, dword [ebp - 0x1518]
push edx
call ebx
mov eax, dword [ebp - 0x1514]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a187
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor esi, esi
mov dword [ebp - 0x1544], esi
mov dword [ebp - 0x1540], esi
mov dword [ebp - 0x153c], esi
lea ecx, [ebp - 0x1514]
push ecx
mov ebx, 1
mov ecx, str.11.0
mov dword [ebp - 4], ebx
call fcn.00413b80
lea ecx, [ebp - 0x1514]
lea edi, [ebp - 0x1544]
mov byte [ebp - 4], 2
call fcn.00414ab0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1514]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a1ee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x1514]
push ecx
mov ecx, str.12.0
call fcn.00413b80
lea ecx, [ebp - 0x1514]
lea edi, [ebp - 0x1544]
mov byte [ebp - 4], 3
call fcn.00414ab0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1514]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a239
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x1514]
push ecx
mov ecx, str.14.0
call fcn.00413b80
lea ecx, [ebp - 0x1514]
lea edi, [ebp - 0x1544]
mov byte [ebp - 4], 4
call fcn.00414ab0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1514]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a284
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x1514]
push ecx
mov ecx, str.15.0
call fcn.00413b80
lea ecx, [ebp - 0x1514]
lea edi, [ebp - 0x1544]
mov byte [ebp - 4], 5
call fcn.00414ab0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1514]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a2cf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x1514]
push ecx
mov ecx, str.16.0
call fcn.00413b80
lea ecx, [ebp - 0x1514]
lea edi, [ebp - 0x1544]
mov byte [ebp - 4], 6
call fcn.00414ab0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1514]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a31a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x7fe
lea edx, [ebp - 0x150e]
xor ecx, ecx
push esi
push edx
mov word [ebp - 0x1510], cx
call fcn.00429770
add esp, 0xc
lea ecx, [ebp - 0x1510]
call fcn.00401e30
lea eax, [ebp - 0x1528]
push eax
lea ecx, [ebp - 0x1510]
call fcn.00413b80
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x1544]
mov dword [ebp - 0x1514], eax
cmp eax, dword [ebp - 0x1540]
je 0x40a6f4
lea ecx, [ebp - 0x1528]
push ecx
lea edx, [ebp - 0x154c]
push edx
mov ebx, str.SoftwareMicrosoftOffice_
call fcn.004141a0
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x1514]
push ecx
lea edx, [ebp - 0x1548]
push edx
mov ebx, eax
call fcn.004140f0
push eax
lea eax, [ebp - 0x152c]
push eax
mov ebx, str.ExcelOptions
mov byte [ebp - 4], 9
call fcn.004141a0
add esp, 0x18
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x1548]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a3e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x154c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a407
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebp - 0x152c]
lea ecx, [ebp - 0x1518]
push ecx
push 0xf013f
xor esi, esi
push esi
push edx
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a6ae
push 0x1fe
lea ecx, [ebp - 0x30e]
push esi
push ecx
mov dword [ebp - 0x1530], esi
mov word [ebp - 0x310], ax
call fcn.00429770
add esp, 0xc
push 0x1fe
lea eax, [ebp - 0x50e]
xor edx, edx
push esi
push eax
mov word [ebp - 0x510], dx
call fcn.00429770
mov edi, 0xff
add esp, 0xc
mov dword [ebp - 0x1524], edi
mov dword [ebp - 0x151c], esi
mov dword [ebp - 0x1520], edi
mov byte [ebp - 0x110], 0
push 0xfe
lea ecx, [ebp - 0x10f]
push esi
push ecx
call fcn.00429770
add esp, 0xc
lea edx, [ebp - 0x1520]
push edx
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x151c]
push ecx
mov ecx, dword [ebp - 0x1530]
push esi
lea edx, [ebp - 0x1524]
push edx
mov edx, dword [ebp - 0x1518]
lea eax, [ebp - 0x310]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
jne 0x40a518
inc dword [ebp - 0x1530]
push 0x1fe
lea eax, [ebp - 0x310]
push esi
push eax
mov dword [ebp - 0x1524], edi
mov dword [ebp - 0x151c], esi
mov dword [ebp - 0x1520], edi
call fcn.00429770
add esp, 0xc
push edi
lea ecx, [ebp - 0x110]
jmp 0x40a499
cmp eax, esi
jne 0x40a6a1
xor eax, eax
jmp 0x40a530
movzx ecx, word [ebp + eax - 0x310]
mov word [ebp + eax - 0x510], cx
add eax, 2
cmp cx, si
jne 0x40a530
lea eax, [ebp - 0x510]
xor edx, edx
push str.open
push eax
mov word [ebp - 0x508], dx
call fcn.00428238
add esp, 8
test eax, eax
jne 0x40a624
cmp dword [ebp - 0x151c], 1
jne 0x40a624
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x1534], ebx
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0xd
test ecx, 0xffff0000
jne 0x40a65f
mov edx, ecx
movzx edi, dx
call fcn.004196c0
cmp eax, esi
je 0x40a5cb
push eax
mov eax, edi
lea edi, [ebp - 0x1534]
call fcn.00417fa0
mov ebx, dword [ebp - 0x1534]
mov edi, 0xff
mov byte [ebp - 4], 0xc
cmp dword [ebx - 0xc], esi
jl 0x40a608
push str.EMFunc.xla
push ebx
call fcn.004282c3
add esp, 8
cmp eax, esi
je 0x40a608
sub eax, ebx
sar eax, 1
cmp eax, 0xffffffff
je 0x40a608
mov ecx, dword [ebp - 0x1518]
lea eax, [ebp - 0x310]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add ebx, 0xfffffff0
lea edx, [ebx + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x40a624
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
inc dword [ebp - 0x1530]
push 0x1fe
lea ecx, [ebp - 0x310]
push esi
push ecx
mov dword [ebp - 0x1524], edi
mov dword [ebp - 0x151c], esi
mov dword [ebp - 0x1520], edi
call fcn.00429770
add esp, 0xc
push edi
push esi
lea edx, [ebp - 0x110]
push edx
jmp 0x40a49b
lea eax, [ebp - 0x110]
lea edx, [eax + 2]
jmp 0x40a670
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40a670
sub eax, edx
lea ecx, [ebp - 0x110]
sar eax, 1
push ecx
lea edx, [ebp - 0x1534]
push edx
mov ebx, eax
call fcn.00416d10
mov ebx, dword [ebp - 0x1534]
xor esi, esi
jmp 0x40a5d0
mov eax, dword [ebp - 0x1518]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x152c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a6d4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x1514]
add eax, 4
mov dword [ebp - 0x1514], eax
cmp eax, dword [ebp - 0x1540]
jne 0x40a371
mov ebx, 1
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1528]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a719
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1544], 0
je 0x40a76e
mov ebx, dword [ebp - 0x1544]
mov esi, dword [ebp - 0x1540]
mov edi, ebx
cmp ebx, esi
je 0x40a765
jmp 0x40a740
mov eax, dword [edi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a75e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add edi, 4
cmp edi, esi
jne 0x40a740
push ebx
call fcn.00426798
add esp, 4
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0xd0e]
push edx
mov word [ebp - 0xd10], cx
call fcn.00429770
add esp, 0xc
lea ecx, [ebp - 0xd10]
call fcn.00401e30
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
call edx
add eax, 0x10
mov dword [ebp - 0x151c], eax
lea eax, [ebp - 0xd10]
mov dword [ebp - 4], 0xe
test eax, 0xffff0000
jne 0x40a7e1
mov ecx, eax
movzx edi, cx
call fcn.004196c0
test eax, eax
je 0x40a814
push eax
mov eax, edi
lea edi, [ebp - 0x151c]
call fcn.00417fa0
jmp 0x40a814
lea eax, [ebp - 0xd10]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40a7f0
sub eax, edx
lea edx, [ebp - 0xd10]
sar eax, 1
push edx
lea ecx, [ebp - 0x151c]
push ecx
mov ebx, eax
call fcn.00416d10
lea edx, [ebp - 0x151c]
push edx
lea eax, [ebp - 0x152c]
push eax
mov ebx, str.SOFTWAREKingsoftOfficeETAddinsWL
mov dword [ebp - 4], 0xf
call fcn.004141a0
mov edx, dword [ebp - 0x152c]
add esp, 8
lea ecx, [ebp - 0x1528]
push ecx
push 0xf013f
push 0
push edx
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test eax, eax
jne 0x40a880
mov eax, dword [ebp - 0x1528]
push str.EmOfficeAddIn.Connect
push 0x4498c4
push eax
call esi
mov ecx, dword [ebp - 0x1528]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x152c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a8a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x151c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a8cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x1514], eax
mov dword [ebp - 4], 0x10
cmp dword [0x452bb0], 2
jne 0x40a907
push str.SOFTWAREWow6432NodekingsoftOfficeETAddinsWL
lea ecx, [ebp - 0x1514]
push ecx
mov ebx, 0x30
jmp 0x40a918
push str.SOFTWAREkingsoftOfficeETAddinsWL
lea edx, [ebp - 0x1514]
push edx
mov ebx, 0x24
call fcn.00416d10
mov edi, dword [ebp - 0x1514]
lea eax, [ebp - 0x1524]
push eax
push 0xf013f
push 0
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a961
mov ecx, dword [ebp - 0x1524]
push str.EmOfficeAddIn.Connect
push 0x4498c4
push ecx
call esi
mov edx, dword [ebp - 0x1524]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a984
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004267a3
mov esp, ebp
pop ebp
ret