Function at 0x401870
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x41ea28
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x427acc]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor edi, edi
mov esi, str.Try_to_find_Ms_Excel...
mov dword [esp + 0x28], 1
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
call fcn.004027f0
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [esp + 0x20]
push eax
push str.Excel.ApplicationCLSID
push 0x80000000
call ebp
cmp eax, edi
jne 0x401cc8
call fcn.00403b20
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x4018ec
push 0x80004005
call fcn.00401580
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x40], edi
mov dword [esp + 0x2c], 0x104
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, 0x104
or eax, ecx
jge 0x40192e
push 0x104
lea ecx, [esp + 0x1c]
call fcn.00401600
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x2c]
push ecx
push ebx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
cmp ebx, edi
jne 0x401948
xor ecx, ecx
jmp 0x401965
mov ecx, ebx
lea esi, [ecx + 2]
lea ecx, [ecx]
mov dx, word [ecx]
add ecx, 2
cmp dx, di
jne 0x401950
sub ecx, esi
sar ecx, 1
js 0x401b8f
cmp ecx, dword [ebx - 8]
jg 0x401b8f
cmp eax, edi
mov dword [ebx - 0xc], ecx
mov word [ebx + ecx*2], di
jne 0x401c8d
mov edi, ebx
mov ecx, str.CLSID_:__s
call fcn.004028b0
push str.LocalServer32
lea ecx, [esp + 0x38]
call fcn.004023c0
mov esi, eax
push str.CLSID_
lea ecx, [esp + 0x34]
mov byte [esp + 0x44], 1
call fcn.004023c0
lea ecx, [esp + 0x18]
push ecx
push eax
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x4c], 2
call fcn.00402170
push esi
push eax
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x58], 3
call fcn.00402170
mov eax, dword [eax]
add esp, 0x18
lea ecx, [esp + 0x1c]
push ecx
push eax
push 0x80000000
call ebp
mov esi, eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x401a06
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 2
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401a2b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 1
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401a50
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 0
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401a75
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
jne 0x401b99
call fcn.00403b20
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x401a97
push 0x80004005
call fcn.00401580
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x24], ebp
mov byte [esp + 0x40], 4
mov dword [esp + 0x34], 0x104
mov eax, dword [ebp - 8]
mov ecx, 1
sub ecx, dword [ebp - 4]
sub eax, 0x104
or eax, ecx
jge 0x401ada
push 0x104
lea ecx, [esp + 0x28]
call fcn.00401600
mov ebp, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x34]
push ecx
push ebp
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test ebp, ebp
jne 0x401af5
xor eax, eax
jmp 0x401b11
mov eax, ebp
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401b00
sub eax, edx
sar eax, 1
js 0x401b8f
cmp eax, dword [ebp - 8]
jg 0x401b8f
mov dword [ebp - 0xc], eax
push ebp
lea ecx, [esp + 0x18]
mov word [ebp + eax*2], 0
call fcn.004023c0
lea esi, [esp + 0x14]
mov byte [esp + 0x40], 5
call fcn.00402230
mov edi, dword [esp + 0x14]
mov ecx, str.File_path:__s
call fcn.004028b0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401b5d
mov dword [esp + 0x28], 0
mov byte [esp + 0x40], 4
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401b82
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 0
lea eax, [ebp - 0x10]
jmp 0x401c67
push 0x80070057
call fcn.00401580
push str.LocalServer32
lea ecx, [esp + 0x18]
call fcn.004023c0
mov esi, eax
push str.CLSID_
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 6
call fcn.004023c0
lea ecx, [esp + 0x18]
push ecx
push eax
lea edx, [esp + 0x38]
push edx
mov byte [esp + 0x4c], 7
call fcn.00402170
push esi
push eax
lea eax, [esp + 0x48]
push eax
mov byte [esp + 0x58], 8
call fcn.00402170
mov edi, dword [eax]
add esp, 0x18
mov ecx, str.Cannot_open_registry_key_:_HKEY_CLASSES_ROOT_s
call fcn.004028b0
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401c11
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 7
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401c36
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 6
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401c5b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401c80
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401c97
mov esi, str.Cannot_get_CLSID_value
call fcn.004027f0
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebx - 0x10]
mov dword [esp + 0x40], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401cd7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x401cd7
mov edi, str.Excel.ApplicationCLSID
mov ecx, str.Cannot_open_registry_key_:_HKEY_CLASSES_ROOT_s
call fcn.004028b0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret