Function at 0x407ae0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43fc0c
mov eax, dword fs:[0]
push eax
sub esp, 0x440
mov eax, dword [0x450398]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x452bf0]
mov ecx, dword [0x452bec]
cmp ecx, eax
je 0x407b4a
mov edx, dword [ebp - 0x43c]
push edx
push ecx
push eax
call fcn.00418df0
mov edi, dword [0x452bf0]
mov esi, eax
mov eax, dword [ebp - 0x43c]
push eax
mov eax, esi
call fcn.004190a0
add esp, 0x10
mov dword [0x452bf0], esi
cmp dword [0x452bb0], 2
push 0x1fe
sete byte [ebp - 0x42e]
xor ecx, ecx
push ecx
lea edx, [ebp - 0x20e]
push edx
mov word [ebp - 0x210], cx
call fcn.00429770
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
add esp, 0xc
mov ecx, section..data
mov dword [ebp - 0x438], 0x100
call edx
add eax, 0x10
mov dword [ebp - 0x420], eax
push str.Excel.Application.11
lea eax, [ebp - 0x420]
push eax
mov ebx, 0x14
mov dword [ebp - 4], 0
call fcn.00416d10
mov edx, dword [ebp - 0x420]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x41c]
push ecx
push 0x20119
push 0
push edx
push 0x80000000
call esi
test eax, eax
jne 0x407ca8
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
mov edx, dword [section..data]
add eax, 0x10
mov dword [ebp - 0x428], eax
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x424], eax
push str.OFFICE11
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 1
push ecx
mov ebx, 8
mov byte [ebp - 0x42c], 0
call fcn.00416d10
push str.11.0
lea edx, [ebp - 0x424]
push edx
mov ebx, 4
call fcn.00416d10
lea ecx, [ebp - 0x42c]
call fcn.00415770
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x424]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407c86
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407ca8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.Excel.Application.12
lea ecx, [ebp - 0x420]
push ecx
mov ebx, 0x14
call fcn.00416d10
mov eax, dword [ebp - 0x420]
lea edx, [ebp - 0x41c]
push edx
push 0x20119
push 0
push eax
push 0x80000000
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x407dad
mov ecx, dword [ebp - 0x41c]
push ecx
call edi
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
mov edx, dword [section..data]
add eax, 0x10
mov dword [ebp - 0x428], eax
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x424], eax
push str.OFFICE12
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 2
push ecx
mov ebx, 8
mov byte [ebp - 0x42c], 0
call fcn.00416d10
push str.12.0
lea edx, [ebp - 0x424]
push edx
mov ebx, 4
call fcn.00416d10
lea ecx, [ebp - 0x42c]
call fcn.00415770
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x424]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407d8b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407dad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.Excel.Application.14
lea ecx, [ebp - 0x420]
push ecx
mov ebx, 0x14
call fcn.00416d10
mov eax, dword [ebp - 0x420]
lea edx, [ebp - 0x41c]
push edx
push 0x20119
push 0
push eax
push 0x80000000
call esi
test eax, eax
jne 0x40803e
mov ecx, dword [ebp - 0x41c]
push ecx
call edi
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
mov edx, dword [section..data]
add eax, 0x10
mov dword [ebp - 0x428], eax
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x424], eax
mov byte [ebp - 0x42c], 0
push str.OFFICE14
lea ecx, [ebp - 0x428]
push ecx
mov ebx, 8
mov byte [ebp - 4], 3
call fcn.00416d10
push str.14.0
lea edx, [ebp - 0x424]
push edx
mov ebx, 4
call fcn.00416d10
xor eax, eax
cmp byte [ebp - 0x42e], al
jne 0x407e6e
mov byte [ebp - 0x42c], al
jmp 0x407fe5
push 0x200
push eax
mov byte [ebp - 0x42d], al
lea eax, [ebp - 0x210]
push eax
call fcn.00429770
add esp, 0xc
push str.SOFTWAREMicrosoftOffice14.0ExcelInstallRoot
lea ecx, [ebp - 0x420]
push ecx
mov ebx, 0x30
call fcn.00416d10
mov eax, dword [ebp - 0x420]
lea edx, [ebp - 0x41c]
push edx
push 0x20119
push 0
push eax
push 0x80000002
call esi
test eax, eax
jne 0x407f33
lea ecx, [ebp - 0x438]
push ecx
mov ecx, dword [ebp - 0x41c]
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x444]
push eax
push 0
push 0x446a64
push ecx
mov dword [ebp - 0x438], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x407f1c
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407f00
sub eax, edx
sar eax, 1
setne dl
mov byte [ebp - 0x42c], dl
mov bl, 1
jmp 0x407f22
mov bl, byte [ebp - 0x42d]
mov eax, dword [ebp - 0x41c]
push eax
call edi
test bl, bl
jne 0x407fe5
push 0x200
lea ecx, [ebp - 0x210]
push 0
push ecx
call fcn.00429770
add esp, 0xc
mov edx, str.SOFTWAREWow6432NodeMicrosoftOffice14.0ExcelInstallRoot
lea edi, [ebp - 0x420]
call fcn.00413c90
mov eax, dword [ebp - 0x420]
lea edx, [ebp - 0x41c]
push edx
push 0x20119
push 0
push eax
push 0x80000002
call esi
test eax, eax
jne 0x407fe5
lea ecx, [ebp - 0x438]
push ecx
mov ecx, dword [ebp - 0x41c]
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x444]
push eax
push 0
push 0x446a64
push ecx
mov dword [ebp - 0x438], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x407fd8
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407fc0
sub eax, edx
sar eax, 1
sete dl
mov byte [ebp - 0x42c], dl
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x42c]
call fcn.00415770
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x424]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408016
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408038
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Excel.Application.15
lea ecx, [ebp - 0x420]
push ecx
mov ebx, 0x14
call fcn.00416d10
mov eax, dword [ebp - 0x420]
lea edx, [ebp - 0x41c]
push edx
push 0x20119
push 0
push eax
push 0x80000000
call esi
test eax, eax
jne 0x4082b3
mov ecx, dword [ebp - 0x41c]
push ecx
call edi
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
mov edx, dword [section..data]
add eax, 0x10
mov dword [ebp - 0x428], eax
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x424], eax
mov byte [ebp - 0x42c], 0
push str.OFFICE15
lea ecx, [ebp - 0x428]
push ecx
mov ebx, 8
mov byte [ebp - 4], 4
call fcn.00416d10
push str.15.0
lea edx, [ebp - 0x424]
push edx
mov ebx, 4
call fcn.00416d10
xor eax, eax
cmp byte [ebp - 0x42e], al
jne 0x4080ff
mov byte [ebp - 0x42c], al
jmp 0x40825a
push 0x200
push eax
mov byte [ebp - 0x42d], al
lea eax, [ebp - 0x210]
push eax
call fcn.00429770
add esp, 0xc
push str.SOFTWAREMicrosoftOffice15.0ExcelInstallRoot
lea ecx, [ebp - 0x420]
push ecx
mov ebx, 0x30
call fcn.00416d10
mov eax, dword [ebp - 0x420]
lea edx, [ebp - 0x41c]
push edx
push 0x20119
push 0
push eax
push 0x80000002
call esi
test eax, eax
jne 0x4081b9
lea ecx, [ebp - 0x438]
push ecx
mov ecx, dword [ebp - 0x41c]
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x444]
push eax
push 0
push 0x446a64
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4081a2
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408186
sub eax, edx
sar eax, 1
setne dl
mov byte [ebp - 0x42c], dl
mov bl, 1
jmp 0x4081a8
mov bl, byte [ebp - 0x42d]
mov eax, dword [ebp - 0x41c]
push eax
call edi
test bl, bl
jne 0x40825a
push 0x200
lea ecx, [ebp - 0x210]
push 0
push ecx
call fcn.00429770
add esp, 0xc
mov edx, str.SOFTWAREWow6432NodeMicrosoftOffice15.0ExcelInstallRoot
lea edi, [ebp - 0x420]
call fcn.00413c90
mov eax, dword [ebp - 0x420]
lea edx, [ebp - 0x41c]
push edx
push 0x20119
push 0
push eax
push 0x80000002
call esi
test eax, eax
jne 0x40825a
lea ecx, [ebp - 0x438]
push ecx
mov ecx, dword [ebp - 0x41c]
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x444]
push eax
push 0
push 0x446a64
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40824d
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408235
sub eax, edx
sar eax, 1
sete dl
mov byte [ebp - 0x42c], dl
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x42c]
call fcn.00415770
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x424]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40828b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4082ad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Excel.Application.16
lea ecx, [ebp - 0x420]
push ecx
mov ebx, 0x14
call fcn.00416d10
mov eax, dword [ebp - 0x420]
lea edx, [ebp - 0x41c]
push edx
push 0x20119
push 0
push eax
push 0x80000000
call esi
test eax, eax
jne 0x408691
mov ecx, dword [ebp - 0x41c]
push ecx
call edi
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
mov edx, dword [section..data]
add eax, 0x10
mov dword [ebp - 0x428], eax
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x424], eax
mov byte [ebp - 0x42c], 0
push str.OFFICE16
lea ecx, [ebp - 0x428]
push ecx
mov ebx, 8
mov byte [ebp - 4], 5
call fcn.00416d10
push str.16.0
lea edx, [ebp - 0x424]
push edx
mov ebx, 4
call fcn.00416d10
xor eax, eax
cmp byte [ebp - 0x42e], al
jne 0x408374
mov byte [ebp - 0x42c], al
jmp 0x408638
push 0x200
push eax
mov byte [ebp - 0x42d], al
lea eax, [ebp - 0x210]
push eax
call fcn.00429770
add esp, 0xc
push str.SOFTWAREMicrosoftOffice16.0ExcelInstallRoot
lea ecx, [ebp - 0x420]
push ecx
mov ebx, 0x30
call fcn.00416d10
mov eax, dword [ebp - 0x420]
lea edx, [ebp - 0x41c]
push edx
push 0x20119
push 0
push eax
push 0x80000002
call esi
test eax, eax
jne 0x40842d
lea ecx, [ebp - 0x438]
push ecx
mov ecx, dword [ebp - 0x41c]
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x444]
push eax
push 0
push 0x446a64
push ecx
mov dword [ebp - 0x438], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408424
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408405
sub eax, edx
sar eax, 1
setne dl
mov byte [ebp - 0x42c], dl
mov byte [ebp - 0x42d], 1
mov eax, dword [ebp - 0x41c]
push eax
call edi
push 0x200
lea ecx, [ebp - 0x210]
push 0
push ecx
call fcn.00429770
add esp, 0xc
push str.SOFTWAREMicrosoftOfficeClickToRunInventoryOffice16.0
lea edx, [ebp - 0x420]
push edx
mov ebx, 0x3a
call fcn.00416d10
mov ecx, dword [ebp - 0x420]
lea eax, [ebp - 0x41c]
push eax
push 0x20119
push 0
push ecx
push 0x80000002
call esi
test eax, eax
jne 0x408580
lea edx, [ebp - 0x438]
push edx
mov edx, dword [ebp - 0x41c]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x444]
push ecx
push 0
push str.OfficePackageVersion
push edx
mov dword [ebp - 0x438], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408573
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x210]
call fcn.00413b80
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x434]
cmp dword [eax - 0xc], 0
jl 0x40850b
push str.16.0.14332
push eax
call fcn.004282c3
add esp, 8
test eax, eax
je 0x40850b
sub eax, dword [ebp - 0x434]
sar eax, 1
cmp eax, 0xffffffff
je 0x40850b
mov edx, str.21.0
lea edi, [ebp - 0x424]
call fcn.00413c90
jmp 0x40854d
mov ecx, str.16.0.13029
lea esi, [ebp - 0x434]
call fcn.00414050
cmp eax, 0xffffffff
je 0x408527
mov edx, str.19.0
jmp 0x40853c
mov ecx, str.16.0.14026
lea esi, [ebp - 0x434]
call fcn.00414050
mov edx, str.16.0
lea edi, [ebp - 0x424]
call fcn.00413c90
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x434]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408573
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x41c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x42d], 0
jne 0x408638
push 0x200
lea edx, [ebp - 0x210]
push 0
push edx
call fcn.00429770
add esp, 0xc
mov edx, str.SOFTWAREWow6432NodeMicrosoftOffice16.0ExcelInstallRoot
lea edi, [ebp - 0x420]
call fcn.00413c90
mov ecx, dword [ebp - 0x420]
lea eax, [ebp - 0x41c]
push eax
push 0x20119
push 0
push ecx
push 0x80000002
call esi
test eax, eax
jne 0x408638
lea edx, [ebp - 0x438]
push edx
mov edx, dword [ebp - 0x41c]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x444]
push ecx
push 0
push 0x446a64
push edx
mov dword [ebp - 0x438], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40862b
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408613
sub eax, edx
sar eax, 1
sete al
mov byte [ebp - 0x42c], al
mov ecx, dword [ebp - 0x41c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x42c]
call fcn.00415770
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x424]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408669
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40868b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x452bac]
cmp eax, 8
je 0x4086a4
cmp eax, 9
jne 0x408e07
push str.PackagedComProgIdIndexExcel.Application.11
lea ecx, [ebp - 0x420]
push ecx
mov ebx, 0x2c
call fcn.00416d10
mov eax, dword [ebp - 0x420]
lea edx, [ebp - 0x41c]
push edx
push 0x20119
push 0
push eax
push 0x80000000
call esi
test eax, eax
jne 0x4087aa
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
mov edx, dword [section..data]
add eax, 0x10
mov dword [ebp - 0x428], eax
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x424], eax
mov byte [ebp - 0x42c], 0
push str.OFFICE11
lea ecx, [ebp - 0x428]
push ecx
mov ebx, 8
mov byte [ebp - 4], 7
call fcn.00416d10
push str.11.0
lea edx, [ebp - 0x424]
push edx
mov ebx, 4
call fcn.00416d10
xor bl, bl
lea ecx, [ebp - 0x42c]
mov byte [ebp - 0x42c], bl
call fcn.00415770
mov eax, dword [ebp - 0x41c]
push eax
call edi
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x424]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408788
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4087aa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.PackagedComProgIdIndexExcel.Application.12
lea ecx, [ebp - 0x420]
push ecx
mov ebx, 0x2c
call fcn.00416d10
mov eax, dword [ebp - 0x420]
lea edx, [ebp - 0x41c]
push edx
push 0x20119
push 0
push eax
push 0x80000000
call esi
test eax, eax
jne 0x4088af
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
mov edx, dword [section..data]
add eax, 0x10
mov dword [ebp - 0x428], eax
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x424], eax
mov byte [ebp - 0x42c], 0
push str.OFFICE12
lea ecx, [ebp - 0x428]
mov ebx, 8
push ecx
mov byte [ebp - 4], bl
call fcn.00416d10
push str.12.0
lea edx, [ebp - 0x424]
push edx
mov ebx, 4
call fcn.00416d10
xor bl, bl
lea ecx, [ebp - 0x42c]
mov byte [ebp - 0x42c], bl
call fcn.00415770
mov eax, dword [ebp - 0x41c]
push eax
call edi
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x424]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40888d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4088af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.PackagedComProgIdIndexExcel.Application.14
lea ecx, [ebp - 0x420]
push ecx
mov ebx, 0x2c
call fcn.00416d10
mov eax, dword [ebp - 0x420]
lea edx, [ebp - 0x41c]
push edx
push 0x20119
push 0
push eax
push 0x80000000
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x408a7b
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
mov edx, dword [section..data]
add eax, 0x10
mov dword [ebp - 0x428], eax
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x424], eax
mov byte [ebp - 0x42c], 0
push str.OFFICE14
lea ecx, [ebp - 0x428]
push ecx
mov ebx, 8
mov byte [ebp - 4], 9
call fcn.00416d10
push str.14.0
lea edx, [ebp - 0x424]
push edx
mov ebx, 4
call fcn.00416d10
xor ebx, ebx
cmp byte [ebp - 0x42e], bl
jne 0x40896d
mov byte [ebp - 0x42c], bl
jmp 0x408a1c
push 0x206
lea ecx, [ebp - 0x416]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x418], ax
call fcn.00429770
mov ecx, dword [ebp - 0x41c]
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x43c]
push edx
lea eax, [ebp - 0x418]
push eax
push ebx
push ecx
mov dword [ebp - 0x43c], 0x100
call edi
test eax, eax
jne 0x408a1c
lea edx, [ebp - 0x434]
push edx
lea ecx, [ebp - 0x418]
call fcn.00413b80
mov ecx, dword [ebp - 0x434]
cmp dword [ecx - 0xc], ebx
jl 0x4089fa
push str._x64
push ecx
call fcn.004282c3
mov ecx, dword [ebp - 0x434]
add esp, 8
cmp eax, ebx
je 0x4089fa
sub eax, ecx
sar eax, 1
mov byte [ebp - 0x42c], 1
cmp eax, 0xffffffff
jne 0x408a00
mov byte [ebp - 0x42c], bl
lea eax, [ecx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408a1c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x42c]
call fcn.00415770
mov ecx, dword [ebp - 0x41c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x424]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408a59
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408a7b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.PackagedComProgIdIndexExcel.Application.15
lea ecx, [ebp - 0x420]
push ecx
mov ebx, 0x2c
call fcn.00416d10
mov eax, dword [ebp - 0x420]
lea edx, [ebp - 0x41c]
push edx
push 0x20119
push 0
push eax
push 0x80000000
call esi
test eax, eax
jne 0x408c41
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
mov edx, dword [section..data]
add eax, 0x10
mov dword [ebp - 0x428], eax
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x424], eax
mov byte [ebp - 0x42c], 0
push str.OFFICE15
lea ecx, [ebp - 0x428]
push ecx
mov ebx, 8
mov byte [ebp - 4], 0xa
call fcn.00416d10
push str.15.0
lea edx, [ebp - 0x424]
push edx
mov ebx, 4
call fcn.00416d10
xor ebx, ebx
cmp byte [ebp - 0x42e], bl
jne 0x408b33
mov byte [ebp - 0x42c], bl
jmp 0x408be2
push 0x206
lea ecx, [ebp - 0x416]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x418], ax
call fcn.00429770
mov ecx, dword [ebp - 0x41c]
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x43c]
push edx
lea eax, [ebp - 0x418]
push eax
push ebx
push ecx
mov dword [ebp - 0x43c], 0x100
call edi
test eax, eax
jne 0x408be2
lea edx, [ebp - 0x434]
push edx
lea ecx, [ebp - 0x418]
call fcn.00413b80
mov ecx, dword [ebp - 0x434]
cmp dword [ecx - 0xc], ebx
jl 0x408bc0
push str._x64
push ecx
call fcn.004282c3
mov ecx, dword [ebp - 0x434]
add esp, 8
cmp eax, ebx
je 0x408bc0
sub eax, ecx
sar eax, 1
mov byte [ebp - 0x42c], 1
cmp eax, 0xffffffff
jne 0x408bc6
mov byte [ebp - 0x42c], bl
lea eax, [ecx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408be2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x42c]
call fcn.00415770
mov ecx, dword [ebp - 0x41c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x424]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408c1f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408c41
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.PackagedComProgIdIndexExcel.Application.16
lea ecx, [ebp - 0x420]
push ecx
mov ebx, 0x2c
call fcn.00416d10
mov eax, dword [ebp - 0x420]
lea edx, [ebp - 0x41c]
push edx
push 0x20119
push 0
push eax
push 0x80000000
call esi
test eax, eax
jne 0x408e07
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
mov edx, dword [section..data]
add eax, 0x10
mov dword [ebp - 0x428], eax
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x424], eax
mov byte [ebp - 0x42c], 0
push str.OFFICE16
lea ecx, [ebp - 0x428]
push ecx
mov ebx, 8
mov byte [ebp - 4], 0xb
call fcn.00416d10
push str.16.0
lea edx, [ebp - 0x424]
push edx
mov ebx, 4
call fcn.00416d10
xor ebx, ebx
cmp byte [ebp - 0x42e], bl
jne 0x408cf9
mov byte [ebp - 0x42c], bl
jmp 0x408da8
push 0x206
lea ecx, [ebp - 0x416]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x418], ax
call fcn.00429770
mov ecx, dword [ebp - 0x41c]
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x43c]
push edx
lea eax, [ebp - 0x418]
push eax
push ebx
push ecx
mov dword [ebp - 0x43c], 0x100
call edi
test eax, eax
jne 0x408da8
lea edx, [ebp - 0x434]
push edx
lea ecx, [ebp - 0x418]
call fcn.00413b80
mov ecx, dword [ebp - 0x434]
cmp dword [ecx - 0xc], ebx
jl 0x408d86
push str._x64
push ecx
call fcn.004282c3
mov ecx, dword [ebp - 0x434]
add esp, 8
cmp eax, ebx
je 0x408d86
sub eax, ecx
sar eax, 1
mov byte [ebp - 0x42c], 1
cmp eax, 0xffffffff
jne 0x408d8c
mov byte [ebp - 0x42c], bl
lea eax, [ecx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408da8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x42c]
call fcn.00415770
mov ecx, dword [ebp - 0x41c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x424]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408de5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408e07
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x452bec]
cmp ecx, dword [0x452bf0]
jne 0x409314
push str.Excel.ApplicationCurVer
lea edx, [ebp - 0x420]
push edx
mov ebx, 0x18
mov byte [ebp - 0x42d], 1
call fcn.00416d10
mov ecx, dword [ebp - 0x420]
lea eax, [ebp - 0x41c]
push eax
push 0x20119
push 0
push ecx
push 0x80000000
call esi
test eax, eax
jne 0x409314
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
mov edx, dword [section..data]
add eax, 0x10
mov dword [ebp - 0x428], eax
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x424], eax
mov byte [ebp - 0x42c], 0
push 0x200
lea ecx, [ebp - 0x210]
push 0
push ecx
mov byte [ebp - 4], 0xc
mov bl, 1
call fcn.00429770
add esp, 0xc
lea edx, [ebp - 0x438]
push edx
mov edx, dword [ebp - 0x41c]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x444]
push ecx
push 0
push 0x4498c4
push edx
mov dword [ebp - 0x438], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40905c
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x210]
call fcn.00413b80
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x440]
push str.Excel.Application.11
push ecx
call fcn.00428238
add esp, 8
test eax, eax
jne 0x408f45
mov edx, str.OFFICE11
lea edi, [ebp - 0x428]
mov byte [ebp - 0x42c], al
call fcn.00413c90
mov edx, str.11.0
lea edi, [ebp - 0x424]
call fcn.00413c90
xor bl, bl
jmp 0x409036
mov edx, dword [ebp - 0x440]
push str.Excel.Application.12
push edx
call fcn.00428238
add esp, 8
test eax, eax
jne 0x408f8a
mov edx, str.OFFICE12
lea edi, [ebp - 0x428]
mov byte [ebp - 0x42c], al
call fcn.00413c90
mov edx, str.12.0
lea edi, [ebp - 0x424]
call fcn.00413c90
xor bl, bl
jmp 0x409036
lea eax, [ebp - 0x440]
push eax
mov ecx, str.Excel.Application.14
call fcn.00413d10
test eax, eax
jne 0x408fc1
mov edx, str.OFFICE14
lea edi, [ebp - 0x428]
call fcn.00413c90
mov edx, str.14.0
lea edi, [ebp - 0x424]
call fcn.00413c90
jmp 0x409036
lea ecx, [ebp - 0x440]
push ecx
mov ecx, str.Excel.Application.15
call fcn.00413d10
test eax, eax
jne 0x408ff8
mov edx, str.OFFICE15
lea edi, [ebp - 0x428]
call fcn.00413c90
mov edx, str.15.0
lea edi, [ebp - 0x424]
call fcn.00413c90
jmp 0x409036
lea edx, [ebp - 0x440]
push edx
mov ecx, str.Excel.Application.16
call fcn.00413d10
test eax, eax
jne 0x40902f
mov edx, str.OFFICE16
lea edi, [ebp - 0x428]
call fcn.00413c90
mov edx, str.16.0
lea edi, [ebp - 0x424]
call fcn.00413c90
jmp 0x409036
mov byte [ebp - 0x42d], 0
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x440]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40905c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x41c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x4092b8
cmp byte [ebp - 0x42e], 0
jne 0x409086
mov byte [ebp - 0x42c], 0
jmp 0x4092b8
push 0x200
lea edx, [ebp - 0x210]
push 0
push edx
call fcn.00429770
lea eax, [ebp - 0x44c]
push str.SOFTWAREMicrosoftOffice_
push eax
lea ecx, [ebp - 0x424]
mov byte [ebp - 0x445], 0
call fcn.00414280
push eax
lea ecx, [ebp - 0x43c]
push ecx
mov ebx, str.ExcelInstallRoot
mov byte [ebp - 4], 0xe
call fcn.004141a0
add esp, 0x1c
lea edi, [ebp - 0x420]
mov byte [ebp - 4], 0xf
call fcn.00413c20
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x43c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409105
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x44c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40912b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebp - 0x420]
lea ecx, [ebp - 0x41c]
push ecx
push 0x20119
push 0
push edx
push 0x80000002
call esi
test eax, eax
jne 0x4091c7
lea eax, [ebp - 0x438]
push eax
mov eax, dword [ebp - 0x41c]
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x444]
push edx
push 0
push 0x446a64
push eax
mov dword [ebp - 0x438], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4091ac
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
jmp 0x409190
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409190
sub eax, edx
sar eax, 1
setne cl
mov byte [ebp - 0x42c], cl
mov bl, 1
jmp 0x4091b2
mov bl, byte [ebp - 0x445]
mov edx, dword [ebp - 0x41c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x4092b8
push 0x200
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00429770
lea ecx, [ebp - 0x44c]
push str.SOFTWAREWow6432NodeMicrosoftOffice_
push ecx
lea ecx, [ebp - 0x424]
call fcn.00414280
push eax
lea edx, [ebp - 0x43c]
push edx
mov ebx, str.ExcelInstallRoot
mov byte [ebp - 4], 0x10
call fcn.004141a0
add esp, 0x1c
lea edi, [ebp - 0x420]
mov byte [ebp - 4], 0x11
call fcn.00413c20
lea eax, [ebp - 0x43c]
call fcn.00415c70
lea eax, [ebp - 0x44c]
mov byte [ebp - 4], 0xc
call fcn.00415c70
mov ecx, dword [ebp - 0x420]
lea eax, [ebp - 0x41c]
push eax
push 0x20119
push 0
push ecx
push 0x80000002
call esi
test eax, eax
jne 0x4092b8
lea edx, [ebp - 0x438]
push edx
mov edx, dword [ebp - 0x41c]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x444]
push ecx
push 0
push 0x446a64
push edx
mov dword [ebp - 0x438], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4092ab
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409293
sub eax, edx
sar eax, 1
sete al
mov byte [ebp - 0x42c], al
mov ecx, dword [ebp - 0x41c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x42d], 0
je 0x4092cc
lea ecx, [ebp - 0x42c]
call fcn.00415770
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x424]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4092f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409314
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x452bf0]
mov ebx, dword [0x452bec]
sub ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ecx, edx
xor edi, edi
shr ecx, 0x1f
add ecx, edx
mov dword [ebp - 0x43c], edi
je 0x4096b2
mov dword [ebp - 0x44c], edi
jmp 0x409350
mov edx, dword [ebp - 0x44c]
mov eax, dword [edx + ebx + 8]
lea edi, [edx + ebx]
mov ecx, str.16.0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x409388
test dx, dx
je 0x409384
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x409388
add eax, 4
add ecx, 4
test dx, dx
jne 0x409362
xor eax, eax
jmp 0x40938d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x409678
cmp byte [edi], 0
jne 0x409503
cmp byte [ebp - 0x42e], 0
je 0x409503
push 0x200
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00429770
add esp, 0xc
push str.SOFTWAREWow6432NodeMicrosoftOfficeClickToRunInventoryOffice16.0
lea ecx, [ebp - 0x420]
push ecx
mov ebx, 0x46
call fcn.00416d10
mov eax, dword [ebp - 0x420]
lea edx, [ebp - 0x41c]
push edx
push 0x20119
push 0
push eax
push 0x80000002
call esi
test eax, eax
jne 0x409678
lea ecx, [ebp - 0x438]
push ecx
mov ecx, dword [ebp - 0x41c]
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x444]
push eax
push 0
push str.OfficePackageVersion
push ecx
mov dword [ebp - 0x438], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40966b
lea edx, [ebp - 0x434]
push edx
lea ecx, [ebp - 0x210]
call fcn.00413b80
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x434]
cmp dword [ecx - 0xc], 0
jl 0x4094c1
push str.16.0.14332
push ecx
call fcn.004282c3
mov ecx, dword [ebp - 0x434]
add esp, 8
test eax, eax
je 0x40948d
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x40948d
add edi, 4
mov edx, str.OFFICE21
call fcn.00413c90
jmp 0x4094e4
cmp dword [ecx - 0xc], 0
jl 0x4094c1
push str.16.0.13029
push ecx
call fcn.004282c3
add esp, 8
test eax, eax
je 0x4094c1
sub eax, dword [ebp - 0x434]
sar eax, 1
cmp eax, 0xffffffff
je 0x4094c1
add edi, 4
mov edx, str.OFFICE19
call fcn.00413c90
jmp 0x4094e4
mov ecx, str.16.0.14026
lea esi, [ebp - 0x434]
call fcn.00414050
add edi, 4
mov edx, str.OFFICE16
call fcn.00413c90
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x434]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x40965f
push 0x200
lea edx, [ebp - 0x210]
push 0
push edx
call fcn.00429770
add esp, 0xc
push str.SOFTWAREMicrosoftOfficeClickToRunInventoryOffice16.0
lea eax, [ebp - 0x420]
push eax
mov ebx, 0x3a
call fcn.00416d10
mov edx, dword [ebp - 0x420]
lea ecx, [ebp - 0x41c]
push ecx
push 0x20119
push 0
push edx
push 0x80000002
call esi
test eax, eax
jne 0x409678
lea eax, [ebp - 0x438]
push eax
mov eax, dword [ebp - 0x41c]
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x444]
push edx
push 0
push str.OfficePackageVersion
push eax
mov dword [ebp - 0x438], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40966b
lea ecx, [ebp - 0x440]
push ecx
lea ecx, [ebp - 0x210]
call fcn.00413b80
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x440]
cmp dword [ecx - 0xc], 0
jl 0x409638
push str.16.0.14332
push ecx
call fcn.004282c3
mov ecx, dword [ebp - 0x440]
add esp, 8
test eax, eax
je 0x4095ea
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x4095ea
lea eax, [edi + 4]
push str.OFFICE21
push eax
mov ebx, 8
call fcn.00416d10
jmp 0x409645
cmp dword [ecx - 0xc], 0
jl 0x409638
push str.16.0.13029
push ecx
call fcn.004282c3
mov ecx, dword [ebp - 0x440]
add esp, 8
test eax, eax
je 0x409618
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x409618
mov edx, str.OFFICE19
jmp 0x40963d
cmp dword [ecx - 0xc], 0
jl 0x409638
push str.16.0.14026
push ecx
call fcn.004282c3
add esp, 8
test eax, eax
je 0x409638
sub eax, dword [ebp - 0x440]
sar eax, 1
mov edx, str.OFFICE16
add edi, 4
call fcn.00413c90
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x440]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40966b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x41c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x452bf0]
mov ebx, dword [0x452bec]
mov edi, dword [ebp - 0x43c]
add dword [ebp - 0x44c], 0xc
sub ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
mov dword [ebp - 0x43c], edi
cmp edi, eax
jb 0x409350
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x420]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4096db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004267a3
mov esp, ebp
pop ebp
ret