Function at 0x405300
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x431096
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.SOFTWAREClassesPowerPoint.OpenDocumentPresentation.12ShellOpencommand_
lea ecx, [esp + 0xc]
stosb byte es:[edi], al
call fcn.00429402
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0xc]
mov dword [esp + 0x220], 0
push eax
push 0x20019
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x405490
lea edx, [esp + 8]
push str.SOFTWAREWow6432NodeClassesPowerPoint.OpenDocumentPresentation.12ShellOpencommand_
push edx
call fcn.0042445b
mov ecx, dword [esp + 0x10]
add esp, 8
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x405490
lea edx, [esp + 8]
push str.SOFTWAREWow6432NodeClassesPowerPoint.OpenDocumentPresentation.14ShellOpencommand_
push edx
call fcn.0042445b
mov ecx, dword [esp + 0x10]
add esp, 8
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x405490
lea edx, [esp + 8]
push str.SOFTWAREClassesPowerPoint.OpenDocumentPresentation.14ShellOpencommand_
push edx
call fcn.0042445b
mov ecx, dword [esp + 0x10]
add esp, 8
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x405490
lea edx, [esp + 8]
push str.SOFTWAREClassesPowerPoint.OpenDocumentPresentation.16ShellOpencommand_
push edx
call fcn.0042445b
mov ecx, dword [esp + 0x10]
add esp, 8
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x405490
lea edx, [esp + 8]
push str.SOFTWAREWow6432NodeClassesPowerPoint.OpenDocumentPresentation.16ShellOpencommand_
push edx
call fcn.0042445b
mov ecx, dword [esp + 0x10]
add esp, 8
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x405490
lea ecx, [esp + 8]
mov dword [esp + 0x220], 0xffffffff
call fcn.00429394
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x210]
mov dword fs:[0], ecx
add esp, 0x21c
ret
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0
push 0
push ecx
mov dword [esp + 0x2c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4054f1
lea ecx, [esp + 8]
mov dword [esp + 0x220], 0xffffffff
call fcn.00429394
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x210]
mov dword fs:[0], ecx
add esp, 0x21c
ret
mov eax, dword [0x43e9dc]
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
call fcn.0042951d
push 0x442888
push 0x43d94c
lea ecx, [esp + 0x18]
mov byte [esp + 0x228], 1
call fcn.00423e5c
push 0x442888
push 0x43d948
lea ecx, [esp + 0x18]
call fcn.00423e5c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x228]
push edx
push 0x43d7f0
push eax
call fcn.00414f4e
add esp, 0xc
lea ecx, [esp + 0x10]
mov byte [esp + 0x220], 0
call fcn.00429394
lea ecx, [esp + 8]
mov dword [esp + 0x220], 0xffffffff
call fcn.00429394
mov ecx, dword [esp + 0x218]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret