Function at 0x409aa0
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
mov eax, dword [0x5e3fe4]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, cl
lea ecx, [ebp - 0x610]
mov byte [ebp - 0x605], al
movzx eax, al
push edi
inc eax
mov edi, edx
push ecx
shl eax, 8
or eax, 0x20019
push eax
push 0
push str.SoftwareMicrosoftOffice
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x409afd
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054e183
mov esp, ebp
pop ebp
ret
push ebx
xor ebx, ebx
mov dword [ebp - 0x614], 0x100
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
push dword [ebp - 0x610]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x409d1f
push esi
cmp eax, 0xea
je 0x409d1e
test eax, eax
jne 0x409d1e
mov esi, dword [ebp - 0x610]
lea eax, [ebp - 0x634]
push eax
lea edx, [ebp - 0x61c]
inc ebx
lea ecx, [ebp - 0x404]
call fcn.004099f0
add esp, 4
cmp dword [ebp - 0x61c], 0
je 0x409ce6
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x604]
push str._sExcelInstallRoot
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x618]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x604]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409ce6
lea eax, [ebp - 0x60c]
mov dword [ebp - 0x620], 1
push eax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x60c], 0x200
push eax
lea eax, [ebp - 0x620]
push eax
push 0
push str.Path
push dword [ebp - 0x618]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x618]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x409ce6
mov ecx, dword [ebp - 0x60c]
test ecx, ecx
je 0x409ce6
shr ecx, 1
mov dword [ebp - 0x60c], ecx
lea eax, [ecx + ecx]
cmp eax, 0x200
jae 0x409d7d
xor edx, edx
mov word [ebp + eax - 0x204], dx
cmp word [ebp + eax - 0x206], 0x5c
je 0x409c56
mov edx, 0x5c
inc ecx
mov word [ebp + eax - 0x204], dx
mov dword [ebp - 0x60c], ecx
mov eax, 0x100
sub eax, ecx
push str.EXCEL.EXE
push eax
lea eax, [ebp - 0x204]
lea eax, [eax + ecx*2]
push eax
call fcn.0055b621
add esp, 0xc
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x409ce6
lea eax, [ebp - 0x62c]
push eax
lea edx, [ebp - 0x624]
lea ecx, [ebp - 0x404]
call fcn.004099f0
lea eax, [ebp - 0x630]
mov ecx, edi
push eax
lea edx, [ebp - 0x628]
call fcn.004099f0
mov eax, dword [ebp - 0x624]
add esp, 8
cmp eax, dword [ebp - 0x628]
ja 0x409cd4
jne 0x409ce6
mov eax, dword [ebp - 0x62c]
cmp eax, dword [ebp - 0x630]
jbe 0x409ce6
lea eax, [ebp - 0x404]
push eax
push 0x40
push edi
call fcn.0055b621
add esp, 0xc
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x614]
mov dword [ebp - 0x614], 0x100
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
push dword [ebp - 0x610]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x409b35
pop esi
push dword [ebp - 0x610]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [edi], 0
pop ebx
je 0x409d67
mov edx, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x409d37
movzx eax, byte [ebp - 0x605]
sub edx, ecx
xor eax, 1
sar edx, 1
inc eax
shl eax, 5
push eax
lea eax, [edi + edx*2]
push str.Microsoft_Excel_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov ecx, edi
call fcn.004041a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0054e183
mov esp, ebp
pop ebp
ret
call fcn.0054e504
int3