Function at 0x40f5b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44005d
mov eax, dword fs:[0]
push eax
sub esp, 0x8ac
mov eax, dword [0x450398]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x452bb0], 2
mov eax, dword [0x452bec]
sete byte [ebp - 0x815]
mov dword [ebp - 0x820], eax
cmp eax, dword [0x452bf0]
je 0x41061c
jmp 0x40f610
mov eax, dword [ebp - 0x820]
mov edi, dword [eax + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, str.11.0
mov eax, edi
mov dx, word [eax]
xor esi, esi
cmp dx, word [ecx]
jne 0x40f64e
cmp dx, si
je 0x40f64a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40f64e
add eax, 4
add ecx, 4
cmp dx, si
jne 0x40f626
xor eax, eax
jmp 0x40f653
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
sete al
test al, al
je 0x40f78b
mov al, byte [ebp - 0x815]
mov ecx, dword [ebp - 0x820]
mov edi, 0x4484a0
cmp byte [ecx], al
je 0x40f67a
mov edi, str.SOFTWAREWow6432NodeMicrosoftOffice11.0ExcelSecurity
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x824], ebx
mov dword [ebp - 4], esi
cmp edi, esi
je 0x40f6be
test edi, 0xffff0000
jne 0x40f6c2
movzx edi, di
call fcn.004196c0
cmp eax, esi
je 0x40f6ed
push eax
mov eax, edi
lea edi, [ebp - 0x824]
call fcn.00417fa0
jmp 0x40f6e7
xor eax, eax
jmp 0x40f6d6
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40f6c7
sub eax, edx
sar eax, 1
push edi
lea ecx, [ebp - 0x824]
push ecx
mov ebx, eax
call fcn.00416d10
xor esi, esi
mov ebx, dword [ebp - 0x824]
lea edx, [ebp - 0x8a0]
push edx
lea eax, [ebp - 0x814]
push eax
push esi
push 0xf013f
push esi
push esi
push esi
push ebx
mov dword [ebp - 4], 0xffffffff
push 0x80000002
mov dword [ebp - 0x8a0], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4103d0
mov edx, dword [ebp - 0x814]
push 4
lea ecx, [ebp - 0x8b4]
push ecx
push 4
push str.Level
push 0x4498c4
push edx
mov dword [ebp - 0x8b4], 1
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp eax, esi
jne 0x4103f5
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f9c3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x40f9c3
mov ecx, str.12.0
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40f7b8
cmp dx, si
je 0x40f7b4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40f7b8
add eax, 4
add ecx, 4
cmp dx, si
jne 0x40f792
xor eax, eax
jmp 0x40f7bd
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
sete al
test al, al
je 0x40fa51
mov cl, byte [ebp - 0x815]
mov edx, dword [ebp - 0x820]
mov edi, 0x448580
cmp byte [edx], cl
je 0x40f7e4
mov edi, str.SoftwareWow6432NodeMicrosoftOffice12.0ExcelSecurity
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
call edx
add eax, 0x10
mov dword [ebp - 0x824], eax
mov dword [ebp - 4], 1
cmp edi, esi
je 0x40f82b
test edi, 0xffff0000
jne 0x40f82f
movzx edi, di
call fcn.004196c0
cmp eax, esi
je 0x40f85a
push eax
mov eax, edi
lea edi, [ebp - 0x824]
call fcn.00417fa0
jmp 0x40f85a
xor eax, eax
jmp 0x40f843
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40f834
sub eax, edx
sar eax, 1
push edi
lea ecx, [ebp - 0x824]
push ecx
mov ebx, eax
call fcn.00416d10
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor esi, esi
lea edx, [ebp - 0x848]
push edx
lea eax, [ebp - 0x814]
push eax
push esi
push 0xf013f
push esi
push esi
mov dword [ebp - 4], 2
mov edi, dword [ebp - 0x824]
push esi
push edi
push 0x80000002
mov dword [ebp - 0x848], esi
call ebx
cmp eax, esi
jne 0x410414
mov edx, dword [ebp - 0x814]
push 4
lea ecx, [ebp - 0x870]
push ecx
push 4
push str.VBAWarnings
push 0x4498c4
push edx
mov dword [ebp - 0x870], 1
mov dword [ebp - 0x860], esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp eax, esi
jne 0x410420
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x820]
mov cl, byte [ebp - 0x815]
cmp byte [edx], cl
mov edx, str.SoftwareMicrosoftOffice12.0ExcelSecurityFileValidation
je 0x40f8f5
mov edx, str.SoftwareWow6432NodeMicrosoftOffice12.0ExcelSecurityFileValidation
mov eax, edx
lea edi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40f900
sub eax, edi
sar eax, 1
push edx
lea ecx, [ebp - 0x824]
push ecx
mov ebx, eax
call fcn.00416d10
mov edi, dword [ebp - 0x824]
lea edx, [ebp - 0x848]
push edx
xor ebx, ebx
lea eax, [ebp - 0x814]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push edi
push 0x80000002
mov dword [ebp - 0x848], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x410414
mov edx, dword [ebp - 0x814]
push 4
lea ecx, [ebp - 0x860]
push ecx
push 4
push str.EnableOnLoad
push 0x4498c4
push edx
mov dword [ebp - 0x870], 1
mov dword [ebp - 0x860], ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp eax, ebx
jne 0x410420
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f9c1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor esi, esi
push 0x7fe
lea edx, [ebp - 0x80e]
xor ecx, ecx
push esi
push edx
mov word [ebp - 0x810], cx
call fcn.00429770
add esp, 0xc
lea ecx, [ebp - 0x810]
call fcn.00401e30
lea eax, [ebp - 0x81c]
push eax
lea ecx, [ebp - 0x810]
call fcn.00413b80
mov dword [ebp - 4], 6
mov ebx, dword [ebp - 0x820]
mov edi, dword [ebx + 8]
mov ecx, str.11.0
mov eax, edi
jmp 0x40fa20
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40fef3
cmp dx, si
je 0x40fa4a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40fef3
add eax, 4
add ecx, 4
cmp dx, si
jne 0x40fa20
xor eax, eax
jmp 0x40fef8
mov ecx, str.14.0
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40fa7e
cmp dx, si
je 0x40fa7a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40fa7e
add eax, 4
add ecx, 4
cmp dx, si
jne 0x40fa58
xor eax, eax
jmp 0x40fa83
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
sete al
test al, al
je 0x40fbe9
mov cl, byte [ebp - 0x815]
mov edx, dword [ebp - 0x820]
cmp byte [edx], cl
mov ecx, 0x4487a0
je 0x40faaa
mov ecx, str.SoftwareWow6432NodeMicrosoftOffice14.0ExcelSecurity
lea eax, [ebp - 0x828]
push eax
call fcn.00413b80
lea ecx, [ebp - 0x854]
push ecx
lea edx, [ebp - 0x814]
push edx
push esi
push 0xf013f
push esi
push esi
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x828]
push esi
push eax
push 0x80000002
mov dword [ebp - 0x854], esi
call ebx
cmp eax, esi
jne 0x410446
mov edx, dword [ebp - 0x814]
push 4
lea ecx, [ebp - 0x874]
push ecx
push 4
push str.VBAWarnings
push 0x4498c4
push edx
mov dword [ebp - 0x874], 1
mov dword [ebp - 0x858], esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp eax, esi
jne 0x41045b
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x820]
mov cl, byte [ebp - 0x815]
cmp byte [edx], cl
mov edx, str.SoftwareMicrosoftOffice14.0ExcelSecurityFileValidation
je 0x40fb51
mov edx, str.SoftwareWow6432NodeMicrosoftOffice14.0ExcelSecurityFileValidation
lea edi, [ebp - 0x828]
call fcn.00413c90
mov edx, dword [ebp - 0x828]
lea eax, [ebp - 0x854]
push eax
lea ecx, [ebp - 0x814]
push ecx
push esi
push 0xf013f
push esi
push esi
push esi
push edx
push 0x80000002
mov dword [ebp - 0x854], esi
call ebx
cmp eax, esi
jne 0x410446
mov ecx, dword [ebp - 0x814]
push 4
lea eax, [ebp - 0x858]
push eax
push 4
push str.EnableOnLoad
push 0x4498c4
push ecx
mov dword [ebp - 0x874], 1
mov dword [ebp - 0x858], esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp eax, esi
jne 0x41048a
mov edx, dword [ebp - 0x814]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov dword [ebp - 4], 0xffffffff
call fcn.00415c70
jmp 0x40f9c3
mov ecx, str.15.0
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40fc16
cmp dx, si
je 0x40fc12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40fc16
add eax, 4
add ecx, 4
cmp dx, si
jne 0x40fbf0
xor eax, eax
jmp 0x40fc1b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
sete al
test al, al
je 0x40fd7b
mov al, byte [ebp - 0x815]
mov edi, dword [ebp - 0x820]
mov ecx, 0x448990
cmp byte [edi], al
je 0x40fc42
mov ecx, str.SoftwareWow6432NodeMicrosoftOffice15.0ExcelSecurity
lea edx, [ebp - 0x82c]
push edx
call fcn.00413b80
lea eax, [ebp - 0x850]
push eax
lea ecx, [ebp - 0x814]
push ecx
push esi
push 0xf013f
push esi
push esi
mov dword [ebp - 4], 4
mov edx, dword [ebp - 0x82c]
push esi
push edx
push 0x80000002
mov dword [ebp - 0x850], esi
call ebx
cmp eax, esi
jne 0x4104af
mov ecx, dword [ebp - 0x814]
push 4
lea eax, [ebp - 0x868]
push eax
push 4
push str.VBAWarnings
push 0x4498c4
push ecx
mov dword [ebp - 0x868], 1
mov dword [ebp - 0x85c], esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp eax, esi
jne 0x4104a2
mov edx, dword [ebp - 0x814]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x815]
mov edx, str.SoftwareMicrosoftOffice15.0ExcelSecurityFileValidation
cmp byte [edi], al
je 0x40fce3
mov edx, str.SoftwareWow6432NodeMicrosoftOffice15.0ExcelSecurityFileValidation
lea edi, [ebp - 0x82c]
call fcn.00413c90
mov eax, dword [ebp - 0x82c]
lea ecx, [ebp - 0x850]
push ecx
lea edx, [ebp - 0x814]
push edx
push esi
push 0xf013f
push esi
push esi
push esi
push eax
push 0x80000002
mov dword [ebp - 0x850], esi
call ebx
test eax, eax
jne 0x4104de
mov edx, dword [ebp - 0x814]
push 4
lea ecx, [ebp - 0x85c]
push ecx
push 4
push str.EnableOnLoad
push 0x4498c4
push edx
mov dword [ebp - 0x868], 1
mov dword [ebp - 0x85c], esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp eax, esi
jne 0x4104d1
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov dword [ebp - 4], 0xffffffff
call fcn.00415c70
jmp 0x40f9c3
mov eax, dword [ebp - 0x820]
add eax, 8
push eax
mov ecx, str.16.0
call fcn.00414360
add esp, 4
test al, al
je 0x40f9c3
mov cl, byte [ebp - 0x815]
mov edi, dword [ebp - 0x820]
cmp byte [edi], cl
mov ecx, 0x448b80
je 0x40fdb4
mov ecx, str.SoftwareWow6432NodeMicrosoftOffice16.0ExcelSecurity
lea edx, [ebp - 0x830]
push edx
call fcn.00413b80
lea eax, [ebp - 0x84c]
push eax
lea ecx, [ebp - 0x814]
push ecx
push esi
push 0xf013f
push esi
push esi
mov dword [ebp - 4], 5
mov edx, dword [ebp - 0x830]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push esi
push edx
push 0x80000002
mov dword [ebp - 0x84c], esi
call ebx
cmp eax, esi
jne 0x4104e9
mov ecx, dword [ebp - 0x814]
push 4
lea eax, [ebp - 0x864]
push eax
push 4
push str.VBAWarnings
push 0x4498c4
push ecx
mov dword [ebp - 0x864], 1
mov dword [ebp - 0x86c], esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x41050b
mov edx, dword [ebp - 0x814]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x815]
mov edx, str.SoftwareMicrosoftOffice16.0ExcelSecurityFileValidation
cmp byte [edi], al
je 0x40fe5b
mov edx, str.SoftwareWow6432NodeMicrosoftOffice16.0ExcelSecurityFileValidation
lea edi, [ebp - 0x830]
call fcn.00413c90
mov eax, dword [ebp - 0x830]
lea ecx, [ebp - 0x84c]
push ecx
lea edx, [ebp - 0x814]
push edx
push esi
push 0xf013f
push esi
push esi
push esi
push eax
push 0x80000002
mov dword [ebp - 0x84c], esi
call ebx
test eax, eax
jne 0x410518
mov edx, dword [ebp - 0x814]
push 4
lea ecx, [ebp - 0x86c]
push ecx
push 4
push str.EnableOnLoad
push 0x4498c4
push edx
mov dword [ebp - 0x864], 1
mov dword [ebp - 0x86c], esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp eax, esi
jne 0x410523
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov dword [ebp - 4], 0xffffffff
call fcn.00415c70
jmp 0x40f9c3
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
sete al
test al, al
je 0x40ffcb
lea ecx, [ebp - 0x81c]
push ecx
lea edx, [ebp - 0x834]
push edx
mov ebx, str.SOFTWAREMicrosoftOffice11.0ExcelSecurity
call fcn.004141a0
mov edx, dword [ebp - 0x834]
add esp, 8
lea eax, [ebp - 0x880]
push eax
lea ecx, [ebp - 0x814]
push ecx
push 0
push 0xf013f
push 0
push 0
push 0
push edx
push 0x80000003
mov dword [ebp - 0x880], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41053b
mov ecx, dword [ebp - 0x814]
push 4
lea eax, [ebp - 0x8a8]
push eax
push 4
push str.Level
push 0x4498c4
push ecx
mov dword [ebp - 0x8a8], 1
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x410572
mov edx, dword [ebp - 0x814]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x834]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410387
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x410387
mov ecx, str.12.0
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40fff8
cmp dx, si
je 0x40fff4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40fff8
add eax, 4
add ecx, 4
cmp dx, si
jne 0x40ffd2
xor eax, eax
jmp 0x40fffd
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
sete al
test al, al
je 0x4100d8
lea ecx, [ebp - 0x81c]
push ecx
lea edx, [ebp - 0x840]
push edx
mov ebx, str.SoftwareMicrosoftOffice12.0ExcelSecurity
call fcn.004141a0
mov edx, dword [ebp - 0x840]
add esp, 8
lea eax, [ebp - 0x888]
push eax
xor edi, edi
lea ecx, [ebp - 0x814]
push ecx
push edi
push 0xf013f
push edi
push edi
push edi
push edx
push 0x80000003
mov dword [ebp - 0x888], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x410597
mov ecx, dword [ebp - 0x814]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 4
lea eax, [ebp - 0x878]
push eax
push 4
push str.VBAWarnings
push 0x4498c4
push ecx
mov dword [ebp - 0x878], 1
mov dword [ebp - 0x890], edi
call esi
cmp eax, edi
jne 0x41059f
mov eax, dword [ebp - 0x814]
push 4
lea edx, [ebp - 0x890]
push edx
push 4
push str.EnableOnLoad
push str.FileValidation
push eax
call esi
cmp eax, edi
jne 0x41059f
mov ecx, dword [ebp - 0x814]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x840]
jmp 0x410382
lea esi, [ebx + 8]
push esi
mov ecx, str.14.0
call fcn.00414360
add esp, 4
test al, al
je 0x4101bf
lea edx, [ebp - 0x81c]
push edx
lea eax, [ebp - 0x844]
push eax
mov ebx, str.SoftwareMicrosoftOffice14.0ExcelSecurity
call fcn.004141a0
mov eax, dword [ebp - 0x844]
add esp, 8
lea ecx, [ebp - 0x8b0]
push ecx
xor edi, edi
lea edx, [ebp - 0x814]
push edx
push edi
push 0xf013f
push edi
push edi
push edi
push eax
push 0x80000003
mov dword [ebp - 0x8b0], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x4105c4
mov edx, dword [ebp - 0x814]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 4
lea ecx, [ebp - 0x898]
push ecx
push 4
push str.VBAWarnings
push 0x4498c4
push edx
mov dword [ebp - 0x898], 1
mov dword [ebp - 0x87c], edi
call esi
test eax, eax
jne 0x4105cf
mov ecx, dword [ebp - 0x814]
push 4
lea eax, [ebp - 0x87c]
push eax
push 4
push str.EnableOnLoad
push str.FileValidation
push ecx
call esi
cmp eax, edi
jne 0x4105cf
mov edx, dword [ebp - 0x814]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x844]
jmp 0x410382
push esi
mov ecx, str.15.0
call fcn.00414360
add esp, 4
test al, al
je 0x4102a3
lea eax, [ebp - 0x81c]
push eax
lea ecx, [ebp - 0x838]
push ecx
mov ebx, str.SoftwareMicrosoftOffice15.0ExcelSecurity
call fcn.004141a0
mov ecx, dword [ebp - 0x838]
add esp, 8
lea edx, [ebp - 0x884]
push edx
xor edi, edi
lea eax, [ebp - 0x814]
push eax
push edi
push 0xf013f
push edi
push edi
push edi
push ecx
push 0x80000003
mov dword [ebp - 0x884], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4105f1
mov eax, dword [ebp - 0x814]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 4
lea edx, [ebp - 0x88c]
push edx
push 4
push str.VBAWarnings
push 0x4498c4
push eax
mov dword [ebp - 0x88c], 1
mov dword [ebp - 0x894], edi
call esi
test eax, eax
jne 0x4105e4
mov edx, dword [ebp - 0x814]
push 4
lea ecx, [ebp - 0x894]
push ecx
push 4
push str.EnableOnLoad
push str.FileValidation
push edx
call esi
cmp eax, edi
jne 0x4105e4
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x838]
jmp 0x410382
push esi
mov ecx, str.16.0
call fcn.00414360
add esp, 4
test al, al
je 0x410387
lea ecx, [ebp - 0x81c]
push ecx
lea edx, [ebp - 0x83c]
push edx
mov ebx, str.SoftwareMicrosoftOffice16.0ExcelSecurity
call fcn.004141a0
mov edx, dword [ebp - 0x83c]
add esp, 8
lea eax, [ebp - 0x89c]
push eax
xor edi, edi
lea ecx, [ebp - 0x814]
push ecx
push edi
push 0xf013f
push edi
push edi
push edi
push edx
push 0x80000003
mov dword [ebp - 0x89c], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x410606
mov ecx, dword [ebp - 0x814]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 4
lea eax, [ebp - 0x8a4]
push eax
push 4
push str.VBAWarnings
push 0x4498c4
push ecx
mov dword [ebp - 0x8a4], 1
mov dword [ebp - 0x8ac], edi
call esi
test eax, eax
jne 0x4105f9
mov eax, dword [ebp - 0x814]
push 4
lea edx, [ebp - 0x8ac]
push edx
push 4
push str.EnableOnLoad
push str.FileValidation
push eax
call esi
cmp eax, edi
jne 0x4105f9
mov ecx, dword [ebp - 0x814]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x83c]
call fcn.00415c70
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x81c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4103b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x820]
add eax, 0xc
mov dword [ebp - 0x820], eax
cmp eax, dword [0x452bf0]
jne 0x40f610
jmp 0x41061c
lea eax, [ebx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41061c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41061c
mov ecx, dword [ebp - 0x814]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebx - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x4103e0
mov dword [ebp - 4], 0xffffffff
lea eax, [edi - 0x10]
jmp 0x4103d3
mov ecx, dword [ebp - 0x814]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x4103e0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x828]
add eax, 0xfffffff0
jmp 0x4103d3
mov ecx, dword [ebp - 0x814]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x828]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x4103e0
mov ecx, dword [ebp - 0x814]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x828]
jmp 0x410617
mov ecx, dword [ebp - 0x814]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x82c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x4103e0
mov ecx, dword [ebp - 0x814]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x82c]
jmp 0x410617
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x830]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x4103e0
mov ecx, dword [ebp - 0x814]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x830]
jmp 0x410617
mov edx, dword [ebp - 0x814]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x830]
jmp 0x410617
mov eax, dword [ebp - 0x834]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41055d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x81c]
add eax, 0xfffffff0
jmp 0x4103d3
mov ecx, dword [ebp - 0x814]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x834]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x410551
mov eax, dword [ebp - 0x840]
jmp 0x410541
mov ecx, dword [ebp - 0x814]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x840]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x410551
mov eax, dword [ebp - 0x844]
jmp 0x410541
mov ecx, dword [ebp - 0x814]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x844]
jmp 0x41060c
mov edx, dword [ebp - 0x814]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x838]
jmp 0x41060c
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x83c]
call fcn.00415c70
lea eax, [ebp - 0x81c]
call fcn.00415c70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004267a3
mov esp, ebp
pop ebp
ret