Function at 0x40d7f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41dc66
push eax
mov dword fs:[0], esp
sub esp, 0x434
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebp
push esi
push edi
push eax
push 1
push 0
push str.CLSID06290BD5_48AA_11D2_8432_006008C3FBFCImplemented_Categories7DD95801_9882_11CF_9FA9_00AA006C42C4
mov esi, ecx
push 0x80000000
call ebx
test eax, eax
jne 0x40d91c
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x24]
push 0x93de
push edx
call fcn.00410710
mov edi, dword [eax]
lea eax, [esp + 0x38]
push 0x93dd
push eax
mov dword [esp + 0x45c], 0
call fcn.00410710
add esp, 0x10
mov eax, dword [eax]
push edi
push eax
mov ecx, esi
mov byte [esp + 0x454], 1
call fcn.004092a0
lea ecx, [esp + 0x30]
mov byte [esp + 0x44c], 0
call fcn.004193cc
or edi, 0xffffffff
lea ecx, [esp + 0x24]
mov dword [esp + 0x44c], edi
call fcn.004193cc
lea ecx, [esp + 0x24]
push 0x93e0
push ecx
call fcn.00410710
add esp, 8
mov eax, dword [eax]
mov ecx, esi
push eax
push 0x429eb4
mov dword [esp + 0x454], 2
call fcn.004092a0
lea ecx, [esp + 0x24]
mov dword [esp + 0x44c], edi
call fcn.004193cc
lea edx, [esp + 0x24]
push 0x93e1
push edx
call fcn.00410710
add esp, 8
mov eax, dword [eax]
mov ecx, esi
push eax
push 0x429eb4
mov dword [esp + 0x454], 3
call fcn.004092a0
lea ecx, [esp + 0x24]
mov dword [esp + 0x44c], edi
call fcn.004193cc
lea eax, [esp + 0x10]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsZones
push 0x80000001
call ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40db89
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x425cbc
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsZones
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
mov byte [esp + 0x1f], 0x31
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsZones
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dl, byte [esp + 0x1f]
mov byte [eax + 0x4253b3], dl
lea eax, [esp + 0x10]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsZones
push 0x80000001
call ebx
test eax, eax
jne 0x40db77
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
mov ebx, 4
push str.1201
push ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
call ebp
test eax, eax
jne 0x40da7f
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x40da7f
lea edx, [esp + 0x14]
lea eax, [esp + 0x140]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push str.DisplayName
push edx
mov byte [esp + 0x158], 0
mov dword [esp + 0x30], 1
mov dword [esp + 0x2c], 0x104
call ebp
lea eax, [esp + 0x24]
push 0x93c2
push eax
call fcn.00410710
mov eax, dword [eax]
add esp, 8
lea ecx, [esp + 0x140]
lea edx, [esp + 0x244]
push ecx
push eax
push edx
call edi
add esp, 0xc
lea ecx, [esp + 0x24]
call fcn.004193cc
lea eax, [esp + 0x30]
push 0x93c3
push eax
call fcn.00410710
add esp, 8
mov eax, dword [eax]
lea ecx, [esp + 0x244]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x454], ebx
call fcn.004092a0
lea ecx, [esp + 0x30]
mov dword [esp + 0x44c], 0xffffffff
call fcn.004193cc
lea edx, [esp + 0x14]
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push str.1004
push edx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
call ebp
test eax, eax
jne 0x40db66
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x40db66
lea eax, [esp + 0x14]
lea ecx, [esp + 0x140]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push str.DisplayName
push eax
mov byte [esp + 0x158], 0
mov dword [esp + 0x30], 1
mov dword [esp + 0x2c], 0x104
call ebp
lea ecx, [esp + 0x28]
push 0x93c2
push ecx
call fcn.00410710
mov eax, dword [eax]
add esp, 8
lea edx, [esp + 0x140]
push edx
push eax
lea eax, [esp + 0x24c]
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0x28]
call fcn.004193cc
lea ecx, [esp + 0x2c]
push 0x93c3
push ecx
call fcn.00410710
add esp, 8
mov eax, dword [eax]
lea edx, [esp + 0x244]
push edx
push eax
mov ecx, esi
mov dword [esp + 0x454], 5
call fcn.004092a0
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44c], 0xffffffff
call fcn.004193cc
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov al, byte [esp + 0x1f]
inc al
cmp al, 0x35
mov byte [esp + 0x1f], al
jl 0x40d965
mov edi, str.SoftwareMicrosoftOffice8.0
push str.SoftwareMicrosoftOffice8.0
sub edi, 3
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x10]
mov byte [eax + edi], 0x38
push ecx
push 1
push 0
push str.SoftwareMicrosoftOffice8.0
push 0x80000001
call ebx
test eax, eax
jne 0x40de94
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x3c]
push str.SoftwareMicrosoftOffice8.0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x3c]
push str.WordOptions
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x3c]
push edx
push 1
push 0
push eax
push 0x80000001
call ebx
test eax, eax
jne 0x40dcbc
lea ecx, [esp + 0x14]
lea edx, [esp + 0x140]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.EnableMacroVirusProtection
push ecx
mov dword [esp + 0x30], 1
mov dword [esp + 0x2c], 0x104
call ebp
test eax, eax
jne 0x40dcb1
cmp byte [esp + 0x140], 0x31
je 0x40dcb1
lea edx, [esp + 0x24]
push 0x93c4
push edx
call fcn.00410710
mov eax, dword [eax]
lea ecx, [esp + 0x30]
push 0x93c5
push ecx
mov dword [esp + 0x45c], 6
mov dword [esp + 0x3c], eax
call fcn.00410710
add esp, 0x10
mov edx, dword [esp + 0x2c]
mov eax, dword [eax]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x454], 7
call fcn.004092a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x44c], 6
call fcn.004193cc
lea ecx, [esp + 0x24]
mov dword [esp + 0x44c], 0xffffffff
call fcn.004193cc
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x3c]
push str.SoftwareMicrosoftOffice8.0
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x3c]
push str.ExcelMicrosoft_Excel
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x3c]
push eax
push 1
push 0
push ecx
push 0x80000001
call ebx
test eax, eax
jne 0x40ddab
mov eax, 4
lea edx, [esp + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push str.Options6
push edx
call ebp
test eax, eax
jne 0x40dda0
mov eax, dword [esp + 0x20]
and eax, 8
cmp al, 8
je 0x40dda0
lea ecx, [esp + 0x24]
push 0x93c4
push ecx
call fcn.00410710
mov edx, dword [eax]
lea eax, [esp + 0x30]
push 0x93c6
push eax
mov dword [esp + 0x45c], 8
mov dword [esp + 0x3c], edx
call fcn.00410710
add esp, 0x10
mov ecx, dword [esp + 0x2c]
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
mov byte [esp + 0x454], 9
call fcn.004092a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x44c], 8
call fcn.004193cc
lea ecx, [esp + 0x24]
mov dword [esp + 0x44c], 0xffffffff
call fcn.004193cc
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x3c]
push str.SoftwareMicrosoftOffice8.0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x3c]
push str.PowerPointOptions
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x3c]
push edx
push 1
push 0
push eax
push 0x80000001
call ebx
test eax, eax
jne 0x40de94
mov eax, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.MacroVirusProtection
push ecx
call ebp
test eax, eax
jne 0x40de89
cmp dword [esp + 0x20], 1
je 0x40de89
lea edx, [esp + 0x28]
push 0x93c4
push edx
call fcn.00410710
mov ebx, dword [eax]
lea eax, [esp + 0x34]
push 0x93c9
push eax
mov dword [esp + 0x45c], 0xa
call fcn.00410710
add esp, 0x10
mov eax, dword [eax]
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x454], 0xb
call fcn.004092a0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x44c], 0xa
call fcn.004193cc
lea ecx, [esp + 0x28]
mov dword [esp + 0x44c], 0xffffffff
call fcn.004193cc
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftwareMicrosoftOffice8.0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [eax + edi]
add eax, edi
lea edx, [esp + 0x10]
inc cl
push edx
push 1
push 0
push str.SoftwareMicrosoftOffice8.0
push 0x80000001
mov byte [eax], cl
call ebx
test eax, eax
jne 0x40e17e
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x3c]
push str.SoftwareMicrosoftOffice8.0
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x3c]
push str.WordOptions
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x3c]
push eax
push 1
push 0
push ecx
push 0x80000001
call ebx
test eax, eax
mov edi, 4
jne 0x40dfb8
lea edx, [esp + 0x14]
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push str.EnableMacroVirusProtection
push edx
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], edi
call ebp
test eax, eax
jne 0x40dfad
cmp dword [esp + 0x20], 1
je 0x40dfad
lea eax, [esp + 0x28]
push 0x93c4
push eax
call fcn.00410710
mov edi, dword [eax]
lea ecx, [esp + 0x34]
push 0x93c7
push ecx
mov dword [esp + 0x45c], 0xc
call fcn.00410710
add esp, 0x10
mov eax, dword [eax]
push edi
push eax
mov ecx, esi
mov byte [esp + 0x454], 0xd
call fcn.004092a0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x44c], 0xc
call fcn.004193cc
lea ecx, [esp + 0x28]
mov dword [esp + 0x44c], 0xffffffff
call fcn.004193cc
mov edi, 4
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x3c]
push str.SoftwareMicrosoftOffice8.0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x3c]
push str.ExcelOptions
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x3c]
push edx
push 1
push 0
push eax
push 0x80000001
call ebx
test eax, eax
jne 0x40e0a0
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.Options6
push ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], edi
call ebp
test eax, eax
jne 0x40e095
mov edx, dword [esp + 0x20]
and edx, 8
cmp dl, 8
je 0x40e095
lea eax, [esp + 0x28]
push 0x93c4
push eax
call fcn.00410710
mov edi, dword [eax]
lea ecx, [esp + 0x34]
push 0x93c8
push ecx
mov dword [esp + 0x45c], 0xe
call fcn.00410710
add esp, 0x10
mov eax, dword [eax]
push edi
push eax
mov ecx, esi
mov byte [esp + 0x454], 0xf
call fcn.004092a0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x44c], 0xe
call fcn.004193cc
lea ecx, [esp + 0x28]
mov dword [esp + 0x44c], 0xffffffff
call fcn.004193cc
mov edi, 4
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x3c]
push str.SoftwareMicrosoftOffice8.0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x3c]
push str.PowerPointOptions
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x3c]
push edx
push 1
push 0
push eax
push 0x80000001
call ebx
test eax, eax
jne 0x40e17e
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.MacroVirusProtection
push ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], edi
call ebp
test eax, eax
jne 0x40e173
cmp dword [esp + 0x20], 1
je 0x40e173
lea edx, [esp + 0x38]
push 0x93c4
push edx
call fcn.00410710
mov edi, dword [eax]
lea eax, [esp + 0x3c]
mov ebx, 0x10
push 0x93ca
push eax
mov dword [esp + 0x45c], ebx
call fcn.00410710
add esp, 0x10
mov eax, dword [eax]
push edi
push eax
mov ecx, esi
mov byte [esp + 0x454], 0x11
call fcn.004092a0
lea ecx, [esp + 0x34]
mov byte [esp + 0x44c], bl
call fcn.004193cc
lea ecx, [esp + 0x38]
mov dword [esp + 0x44c], 0xffffffff
call fcn.004193cc
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x444]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x440
ret