Function at 0x403200
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x41ea28
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x427acc]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor edi, edi
mov esi, 0x422ba8
mov dword [esp + 0x28], 1
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
call fcn.004027f0
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [esp + 0x20]
push eax
push str.Word.ApplicationCLSID
push 0x80000000
call ebp
cmp eax, edi
jne 0x403658
call fcn.00403b20
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x40327c
push 0x80004005
call fcn.00401580
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x40], edi
mov dword [esp + 0x2c], 0x104
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, 0x104
or eax, ecx
jge 0x4032be
push 0x104
lea ecx, [esp + 0x1c]
call fcn.00401600
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x2c]
push ecx
push ebx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
cmp ebx, edi
jne 0x4032d8
xor ecx, ecx
jmp 0x4032f5
mov ecx, ebx
lea esi, [ecx + 2]
lea ecx, [ecx]
mov dx, word [ecx]
add ecx, 2
cmp dx, di
jne 0x4032e0
sub ecx, esi
sar ecx, 1
js 0x40351f
cmp ecx, dword [ebx - 8]
jg 0x40351f
cmp eax, edi
mov dword [ebx - 0xc], ecx
mov word [ebx + ecx*2], di
jne 0x40361d
mov edi, ebx
mov ecx, str.CLSID_:__s
call fcn.004028b0
push str.LocalServer32
lea ecx, [esp + 0x38]
call fcn.004023c0
mov esi, eax
push str.CLSID_
lea ecx, [esp + 0x34]
mov byte [esp + 0x44], 1
call fcn.004023c0
lea ecx, [esp + 0x18]
push ecx
push eax
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x4c], 2
call fcn.00402170
push esi
push eax
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x58], 3
call fcn.00402170
mov eax, dword [eax]
add esp, 0x18
lea ecx, [esp + 0x1c]
push ecx
push eax
push 0x80000000
call ebp
mov esi, eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403396
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 2
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4033bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 1
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4033e0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 0
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403405
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
jne 0x403529
call fcn.00403b20
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x403427
push 0x80004005
call fcn.00401580
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x24], ebp
mov byte [esp + 0x40], 4
mov dword [esp + 0x34], 0x104
mov eax, dword [ebp - 8]
mov ecx, 1
sub ecx, dword [ebp - 4]
sub eax, 0x104
or eax, ecx
jge 0x40346a
push 0x104
lea ecx, [esp + 0x28]
call fcn.00401600
mov ebp, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x34]
push ecx
push ebp
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test ebp, ebp
jne 0x403485
xor eax, eax
jmp 0x4034a1
mov eax, ebp
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403490
sub eax, edx
sar eax, 1
js 0x40351f
cmp eax, dword [ebp - 8]
jg 0x40351f
mov dword [ebp - 0xc], eax
push ebp
lea ecx, [esp + 0x18]
mov word [ebp + eax*2], 0
call fcn.004023c0
lea esi, [esp + 0x14]
mov byte [esp + 0x40], 5
call fcn.00402230
mov edi, dword [esp + 0x14]
mov ecx, str.File_path:__s
call fcn.004028b0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4034ed
mov dword [esp + 0x28], 0
mov byte [esp + 0x40], 4
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403512
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 0
lea eax, [ebp - 0x10]
jmp 0x4035f7
push 0x80070057
call fcn.00401580
push str.LocalServer32
lea ecx, [esp + 0x18]
call fcn.004023c0
mov esi, eax
push str.CLSID_
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 6
call fcn.004023c0
lea ecx, [esp + 0x18]
push ecx
push eax
lea edx, [esp + 0x38]
push edx
mov byte [esp + 0x4c], 7
call fcn.00402170
push esi
push eax
lea eax, [esp + 0x48]
push eax
mov byte [esp + 0x58], 8
call fcn.00402170
mov edi, dword [eax]
add esp, 0x18
mov ecx, str.Cannot_open_registry_key_:_HKEY_CLASSES_ROOT_s
call fcn.004028b0
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4035a1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 7
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4035c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 6
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4035eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403610
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x403627
mov esi, str.Cannot_get_CLSID_value
call fcn.004027f0
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebx - 0x10]
mov dword [esp + 0x40], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403667
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x403667
mov edi, str.Word.ApplicationCLSID
mov ecx, str.Cannot_open_registry_key_:_HKEY_CLASSES_ROOT_s
call fcn.004028b0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret