Function at 0x402920
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x41ea28
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x427acc]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor edi, edi
mov esi, str.Try_to_find_Ms_PowerPoint...
mov dword [esp + 0x28], 1
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
call fcn.004027f0
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [esp + 0x20]
push eax
push str.PowerPoint.ApplicationCLSID
push 0x80000000
call ebp
cmp eax, edi
jne 0x402d78
call fcn.00403b20
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x40299c
push 0x80004005
call fcn.00401580
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x40], edi
mov dword [esp + 0x2c], 0x104
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, 0x104
or eax, ecx
jge 0x4029de
push 0x104
lea ecx, [esp + 0x1c]
call fcn.00401600
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x2c]
push ecx
push ebx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
cmp ebx, edi
jne 0x4029f8
xor ecx, ecx
jmp 0x402a15
mov ecx, ebx
lea esi, [ecx + 2]
lea ecx, [ecx]
mov dx, word [ecx]
add ecx, 2
cmp dx, di
jne 0x402a00
sub ecx, esi
sar ecx, 1
js 0x402c3f
cmp ecx, dword [ebx - 8]
jg 0x402c3f
cmp eax, edi
mov dword [ebx - 0xc], ecx
mov word [ebx + ecx*2], di
jne 0x402d3d
mov edi, ebx
mov ecx, str.CLSID_:__s
call fcn.004028b0
push str.LocalServer32
lea ecx, [esp + 0x38]
call fcn.004023c0
mov esi, eax
push str.CLSID_
lea ecx, [esp + 0x34]
mov byte [esp + 0x44], 1
call fcn.004023c0
lea ecx, [esp + 0x18]
push ecx
push eax
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x4c], 2
call fcn.00402170
push esi
push eax
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x58], 3
call fcn.00402170
mov eax, dword [eax]
add esp, 0x18
lea ecx, [esp + 0x1c]
push ecx
push eax
push 0x80000000
call ebp
mov esi, eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402ab6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 2
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402adb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 1
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402b00
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 0
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402b25
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
jne 0x402c49
call fcn.00403b20
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402b47
push 0x80004005
call fcn.00401580
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x24], ebp
mov byte [esp + 0x40], 4
mov dword [esp + 0x34], 0x104
mov eax, dword [ebp - 8]
mov ecx, 1
sub ecx, dword [ebp - 4]
sub eax, 0x104
or eax, ecx
jge 0x402b8a
push 0x104
lea ecx, [esp + 0x28]
call fcn.00401600
mov ebp, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x34]
push ecx
push ebp
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test ebp, ebp
jne 0x402ba5
xor eax, eax
jmp 0x402bc1
mov eax, ebp
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402bb0
sub eax, edx
sar eax, 1
js 0x402c3f
cmp eax, dword [ebp - 8]
jg 0x402c3f
mov dword [ebp - 0xc], eax
push ebp
lea ecx, [esp + 0x18]
mov word [ebp + eax*2], 0
call fcn.004023c0
lea esi, [esp + 0x14]
mov byte [esp + 0x40], 5
call fcn.00402230
mov edi, dword [esp + 0x14]
mov ecx, str.File_path:__s
call fcn.004028b0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402c0d
mov dword [esp + 0x28], 0
mov byte [esp + 0x40], 4
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402c32
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 0
lea eax, [ebp - 0x10]
jmp 0x402d17
push 0x80070057
call fcn.00401580
push str.LocalServer32
lea ecx, [esp + 0x18]
call fcn.004023c0
mov esi, eax
push str.CLSID_
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 6
call fcn.004023c0
lea ecx, [esp + 0x18]
push ecx
push eax
lea edx, [esp + 0x38]
push edx
mov byte [esp + 0x4c], 7
call fcn.00402170
push esi
push eax
lea eax, [esp + 0x48]
push eax
mov byte [esp + 0x58], 8
call fcn.00402170
mov edi, dword [eax]
add esp, 0x18
mov ecx, str.Cannot_open_registry_key_:_HKEY_CLASSES_ROOT_s
call fcn.004028b0
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402cc1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 7
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402ce6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 6
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402d0b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402d30
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402d47
mov esi, str.Cannot_get_CLSID_value
call fcn.004027f0
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebx - 0x10]
mov dword [esp + 0x40], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402d87
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x402d87
mov edi, str.PowerPoint.ApplicationCLSID
mov ecx, str.Cannot_open_registry_key_:_HKEY_CLASSES_ROOT_s
call fcn.004028b0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret