Function at 0x1000b44c
Capabilities:
Delete registry value
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
push 0x8e0
mov eax, 0x100356c6
call fcn.1001f7cd
mov dword [ebp - 0x8d4], edx
mov dword [ebp - 0x8dc], ecx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x8ac], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x8cc], eax
mov eax, dword [ebp + 0x18]
push 0x1003c550
push ebx
mov dword [ebp - 0x8a4], ebx
mov dword [ebp - 0x8a0], eax
call fcn.10018d09
pop ecx
pop ecx
test eax, eax
jne 0x1000b4a5
inc eax
jmp 0x1000be59
xor edi, edi
mov dword [ebp - 0x8b4], edi
mov dword [ebp - 0x8ec], edi
mov dword [ebp - 0x8e8], edi
mov dword [ebp - 0x8e4], edi
mov dword [ebp - 0x8e0], edi
lea edx, [ebp - 0x8ec]
mov dword [ebp - 4], edi
mov ecx, esi
call fcn.10018d09
test eax, eax
je 0x1000be55
xor esi, esi
inc esi
cmp dword [ebp - 0x8ec], esi
jb 0x1000be55
cmp dword [ebp + 0x1c], edi
jne 0x1000b4fe
cmp dword [ebp - 0x8ec], 0xc
jae 0x1000be57
push 4
pop edi
push 0x1003c3b0
push ebx
call fcn.10018d09
pop ecx
pop ecx
test eax, eax
je 0x1000b534
push 0x1003c438
push ebx
call fcn.10018d09
pop ecx
pop ecx
test eax, eax
je 0x1000b534
push 0x1003c4cc
push ebx
call fcn.10018d09
pop ecx
pop ecx
test eax, eax
jne 0x1000b537
push 0x32
pop edi
push dword [ebp - 0x8e8]
mov eax, 0x104
xor ebx, ebx
push dword [ebp - 0x8ec]
mov dword [ebp - 0x8d0], ebx
push str.SoftwareMicrosoftOffice_d._dCommonGeneral
push eax
lea eax, [ebp - 0x68c]
push eax
call fcn.10018d09
add esp, 0x14
lea eax, [ebp - 0x8d0]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x68c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x8d0], ebx
je 0x1000b5e7
lea eax, [ebp - 0x8bc]
mov dword [ebp - 0x8bc], 4
push eax
lea eax, [ebp - 0x8c4]
push eax
lea eax, [ebp - 0x8b8]
push eax
push ebx
push str.RecentTemplatesList
push dword [ebp - 0x8d0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000b5db
cmp dword [ebp - 0x8b8], 4
jne 0x1000b5db
cmp dword [ebp - 0x8c4], 0xff
cmovbe edi, dword [ebp - 0x8c4]
push dword [ebp - 0x8d0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x8a8], ebx
mov eax, edi
mov edx, 0x104
mul edx
push 2
seto cl
xor ebx, ebx
neg ecx
or eax, ecx
pop ecx
mul ecx
seto bl
neg ebx
or ebx, eax
mov ecx, ebx
call fcn.1001ddcc
mov dword [ebp - 0x8c8], eax
xor ebx, ebx
mov ecx, 0x104
mov eax, edi
mul ecx
push 2
pop edx
seto bl
xor ecx, ecx
neg ebx
or eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
call fcn.1001ddcc
mov dword [ebp - 0x8c0], eax
xor ebx, ebx
mov ecx, 0x824
mov eax, edi
mul ecx
push 2
pop edx
seto bl
xor ecx, ecx
neg ebx
or eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
call fcn.1001ddcc
mov dword [ebp - 0x8b8], eax
xor ebx, ebx
mov ecx, 0x824
mov eax, edi
mul ecx
push 2
pop edx
seto bl
xor ecx, ecx
neg ebx
or eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
call fcn.1001ddcc
mov ebx, eax
mov eax, dword [ebp - 0x8c8]
mov dword [ebp - 0x8c4], ebx
test eax, eax
je 0x1000be22
cmp dword [ebp - 0x8c0], 0
je 0x1000be17
cmp dword [ebp - 0x8b8], 0
je 0x1000be17
test ebx, ebx
je 0x1000be17
push 0x1003d020
push dword [ebp - 0x8a4]
call fcn.10018d09
pop ecx
test eax, eax
mov eax, 0x104
pop ecx
je 0x1000b711
push dword [ebp - 0x8a0]
push dword [ebp - 0x8e8]
push dword [ebp - 0x8ec]
push str.SoftwareMicrosoftOffice_d._d_sRecent_Templates
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.10018d09
add esp, 0x18
jmp 0x1000b728
push 0xffffffffffffffff
push str.SoftwareMicrosoftFrontPageEditorRecent_Templates
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.10018d09
add esp, 0x10
lea eax, [ebp - 0x898]
xor ecx, ecx
push eax
push 3
push ecx
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x898], ecx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x898], 0
jne 0x1000b796
xor ecx, ecx
lea eax, [ebp - 0x898]
push ecx
push eax
push ecx
push 3
push ecx
push 0x1003bac4
push ecx
lea eax, [ebp - 0x27c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, dword [ebp - 0x898]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x898], ecx
test ecx, ecx
je 0x1000be57
test edi, edi
jle 0x1000ba0e
mov ecx, dword [ebp - 0x8c0]
mov eax, esi
mov dword [ebp - 0x8a0], ebx
mov ebx, dword [ebp - 0x8c8]
sub ecx, ebx
mov dword [ebp - 0x8d8], ecx
mov ecx, dword [ebp - 0x8b8]
sub ecx, dword [ebp - 0x8c4]
mov dword [ebp - 0x8a4], eax
mov dword [ebp - 0x8bc], ecx
push eax
push str.Template_d
lea eax, [ebp - 0x74]
mov dword [ebp - 0x89c], esi
push 0x32
push eax
mov dword [ebp - 0x8b0], 0x208
call fcn.10018d09
add esp, 0x10
test eax, eax
je 0x1000ba0e
lea eax, [ebp - 0x8b0]
push eax
push ebx
lea eax, [ebp - 0x89c]
push eax
xor eax, eax
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000ba0e
push 2
pop eax
cmp dword [ebp - 0x89c], esi
je 0x1000b83f
cmp dword [ebp - 0x89c], eax
jne 0x1000ba0e
cmp dword [ebp - 0x89c], eax
jne 0x1000b87f
mov eax, 0x104
push eax
lea eax, [ebp - 0x894]
push eax
push ebx
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
ja 0x1000b87f
test ebx, ebx
je 0x1000b87f
push 0xffffffffffffffff
lea eax, [ebp - 0x894]
push eax
mov eax, 0x104
push eax
push ebx
call fcn.10018d09
add esp, 0x10
push dword [ebp - 0x8a4]
lea eax, [ebp - 0x74]
mov dword [ebp - 0x89c], esi
push str.Friendly_d
push 0x32
push eax
mov dword [ebp - 0x8b0], 0x208
call fcn.10018d09
add esp, 0x10
test eax, eax
je 0x1000ba0e
lea eax, [ebp - 0x8b0]
push eax
mov eax, dword [ebp - 0x8d8]
add eax, ebx
push eax
lea eax, [ebp - 0x89c]
push eax
xor eax, eax
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000ba0e
cmp dword [ebp - 0x89c], esi
jne 0x1000ba0e
push dword [ebp - 0x8a4]
lea eax, [ebp - 0x74]
mov dword [ebp - 0x89c], esi
push str.Thumbnail_d
push 0x32
push eax
mov dword [ebp - 0x8b0], 0x1048
call fcn.10018d09
add esp, 0x10
test eax, eax
je 0x1000b955
lea eax, [ebp - 0x8b0]
push eax
mov eax, dword [ebp - 0x8a0]
add eax, dword [ebp - 0x8bc]
push eax
lea eax, [ebp - 0x89c]
push eax
xor eax, eax
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000b955
cmp dword [ebp - 0x89c], esi
je 0x1000b967
mov eax, dword [ebp - 0x8a0]
xor edx, edx
mov ecx, dword [ebp - 0x8bc]
mov word [ecx + eax], dx
push dword [ebp - 0x8a4]
lea eax, [ebp - 0x74]
mov dword [ebp - 0x89c], esi
push str.Preview_d
push 0x32
push eax
mov dword [ebp - 0x8b0], 0x1048
call fcn.10018d09
add esp, 0x10
test eax, eax
je 0x1000b9c7
lea eax, [ebp - 0x8b0]
push eax
push dword [ebp - 0x8a0]
lea eax, [ebp - 0x89c]
push eax
xor eax, eax
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000b9c7
cmp dword [ebp - 0x89c], esi
je 0x1000b9d4
mov ecx, dword [ebp - 0x8a0]
xor eax, eax
mov word [ecx], ax
jmp 0x1000b9da
mov ecx, dword [ebp - 0x8a0]
mov edx, dword [ebp - 0x8a8]
add ebx, 0x208
mov eax, dword [ebp - 0x8a4]
inc edx
inc eax
mov dword [ebp - 0x8a8], edx
add ecx, 0x1048
mov dword [ebp - 0x8a4], eax
mov dword [ebp - 0x8a0], ecx
cmp edx, edi
jl 0x1000b7d2
xor eax, eax
mov ebx, eax
cmp dword [ebp - 0x8a8], eax
jle 0x1000ba7a
mov eax, dword [ebp - 0x8c8]
lea edx, [edi - 1]
mov dword [ebp - 0x8bc], eax
cmp ebx, edx
jge 0x1000ba7a
push 0x2a
pop ecx
cmp cx, word [eax]
mov ecx, dword [ebp - 0x8a8]
jne 0x1000ba5f
add eax, 2
push eax
push dword [ebp - 0x8dc]
call fcn.10018d09
pop ecx
pop ecx
test eax, eax
je 0x1000ba71
mov eax, dword [ebp - 0x8bc]
lea edx, [edi - 1]
mov ecx, dword [ebp - 0x8a8]
inc ebx
add eax, 0x208
mov dword [ebp - 0x8bc], eax
cmp ebx, ecx
jl 0x1000ba29
jmp 0x1000ba7a
lea edi, [ebx + 1]
mov dword [ebp - 0x8a8], edi
push dword [ebp - 0x8dc]
mov eax, 0x104
push 0x1003d158
push eax
lea eax, [ebp - 0x484]
push eax
call fcn.10018d09
lea ecx, [ebp - 0x484]
add esp, 0x10
lea edx, [ecx + 2]
xor ebx, ebx
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1000baa5
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x484]
push eax
push esi
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.Template1
push dword [ebp - 0x898]
call ebx
mov ecx, dword [ebp - 0x8d4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x8b4]
jne 0x1000bae1
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp - 0x8d4]
xor eax, eax
push esi
push eax
push str.Friendly1
push dword [ebp - 0x898]
call ebx
mov eax, dword [ebp - 0x8ac]
test eax, eax
je 0x1000bb5e
xor ecx, ecx
cmp word [eax], cx
je 0x1000bb5e
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x8b4]
jne 0x1000bb29
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
mov eax, dword [ebp - 0x8ac]
push eax
push esi
xor eax, eax
push eax
push str.Thumbnail1
push dword [ebp - 0x898]
call ebx
jmp 0x1000bb6f
push str.Thumbnail1
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x8cc]
test eax, eax
je 0x1000bbba
xor ecx, ecx
cmp word [eax], cx
je 0x1000bbba
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x8b4]
jne 0x1000bb85
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
mov eax, dword [ebp - 0x8cc]
push eax
push esi
xor eax, eax
push eax
push str.Preview1
push dword [ebp - 0x898]
call ebx
jmp 0x1000bbcb
push str.Preview1
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x8a8]
inc eax
cmp eax, edi
cmovl edi, eax
lea eax, [edi - 1]
mov dword [ebp - 0x8cc], eax
test eax, eax
jle 0x1000bdda
mov edx, dword [ebp - 0x8c0]
mov edi, dword [ebp - 0x8c4]
mov dword [ebp - 0x8a0], edx
mov edx, dword [ebp - 0x8c8]
sub edx, dword [ebp - 0x8c0]
mov dword [ebp - 0x8d8], edx
mov edx, dword [ebp - 0x8b8]
push 2
pop eax
sub edx, edi
mov dword [ebp - 0x8a4], eax
mov dword [ebp - 0x8d4], edx
push eax
push str.Template_d
lea eax, [ebp - 0x74]
push 0x32
push eax
call fcn.10018d09
mov edx, dword [ebp - 0x8d8]
add esp, 0x10
add edx, dword [ebp - 0x8a0]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x8ac], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x8b4]
jne 0x1000bc4e
sub ecx, dword [ebp - 0x8ac]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push esi
xor eax, eax
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x898]
call ebx
push dword [ebp - 0x8a4]
lea eax, [ebp - 0x74]
push str.Friendly_d
push 0x32
push eax
call fcn.10018d09
mov edx, dword [ebp - 0x8a0]
add esp, 0x10
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x8ac], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x8b4]
jne 0x1000bca8
sub ecx, dword [ebp - 0x8ac]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push esi
xor eax, eax
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x898]
call ebx
push dword [ebp - 0x8a4]
lea eax, [ebp - 0x74]
push str.Thumbnail_d
push 0x32
push eax
call fcn.10018d09
mov edx, dword [ebp - 0x8d4]
xor eax, eax
add edx, edi
add esp, 0x10
cmp word [edx], ax
je 0x1000bd3d
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x8ac], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x8b4]
jne 0x1000bd0b
sub ecx, dword [ebp - 0x8ac]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push esi
xor eax, eax
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x898]
call ebx
jmp 0x1000bd4d
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x8a4]
lea eax, [ebp - 0x74]
push str.Preview_d
push 0x32
push eax
call fcn.10018d09
xor eax, eax
add esp, 0x10
cmp word [edi], ax
je 0x1000bda0
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x8b4]
jne 0x1000bd72
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push esi
xor eax, eax
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x898]
call ebx
jmp 0x1000bdb0
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x8a4]
add edi, 0x1048
add dword [ebp - 0x8a0], 0x208
inc eax
sub dword [ebp - 0x8cc], 1
mov dword [ebp - 0x8a4], eax
jne 0x1000bc23
push dword [ebp - 0x8c8]
call fcn.10018d09
push dword [ebp - 0x8c0]
call fcn.10018d09
push dword [ebp - 0x8b8]
call fcn.10018d09
push dword [ebp - 0x8c4]
call fcn.10018d09
add esp, 0x10
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000be57
test eax, eax
je 0x1000be22
push eax
call fcn.10018d09
pop ecx
mov eax, dword [ebp - 0x8c0]
test eax, eax
je 0x1000be33
push eax
call fcn.10018d09
pop ecx
mov eax, dword [ebp - 0x8b8]
test eax, eax
je 0x1000be44
push eax
call fcn.10018d09
pop ecx
test ebx, ebx
je 0x1000be4f
push ebx
call fcn.10018d09
pop ecx
xor eax, eax
mov esi, eax
jmp 0x1000be57
mov esi, edi
mov eax, esi
call fcn.1001f782
ret 0x18