Function at 0x40d289
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
mov eax, dword [0x4132a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x468]
push ebx
push ecx
push 0x101
xor ebx, ebx
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x480], eax
mov eax, dword [ebp + 0x10]
push str.SoftwareMicrosoftOffice16.0ClickToRunStorePackages
push eax
mov dword [ebp - 0x474], eax
mov dword [ebp - 0x468], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d4b2
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x470]
mov dword [ebp - 0x470], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x468]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x40d4a6
mov eax, dword [ebp - 0x470]
test eax, eax
je 0x40d4a6
push esi
mov esi, ebx
push 0x208
lea eax, [ebp - 0x25c]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push 0x4e
lea eax, [ebp - 0x54]
mov dword [ebp - 0x47c], 0x104
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov dword [ebp - 0x484], 0x4e
lea eax, [ebp - 0x484]
mov dword [ebp - 0x478], ebx
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x478]
push eax
push ebx
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x25c]
push eax
push esi
push dword [ebp - 0x468]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x40d3b5
cmp dword [ebp - 0x478], 1
jne 0x40d3b5
mov eax, dword [ebp - 0x47c]
dec eax
push eax
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0x46c]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x40d3c7
inc esi
cmp esi, dword [ebp - 0x470]
jb 0x40d31d
jmp 0x40d4a5
mov esi, dword [ebp - 0x480]
xor eax, eax
cmp dword [ebp - 0x474], 0x80000001
push 0xffffffffffffffff
setne al
inc eax
mov dword [esi], eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [esi + 4]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
push 0xffffffffffffffff
lea eax, [ebp - 0x54]
add esi, 0x20c
push eax
push 0x27
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x20
mov dword [ebp - 0x46c], ebx
lea eax, [ebp - 0x46c]
push eax
push 0x101
push ebx
push esi
push dword [ebp - 0x468]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d4a5
mov esi, 0x208
lea eax, [ebp - 0x464]
push esi
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x474], esi
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x464]
push eax
push ebx
push ebx
push str.JitV32
push dword [ebp - 0x46c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d499
push 0xffffffffffffffff
lea eax, [ebp - 0x464]
push eax
mov eax, dword [ebp - 0x480]
add eax, 0x25a
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x10
mov bl, 1
push dword [ebp - 0x46c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
push dword [ebp - 0x468]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0040d74d
mov esp, ebp
pop ebp
ret 0xc