Function at 0x1000a618
Capabilities:
Delete registry value
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
push 0x8e0
mov eax, 0x100313b0
call fcn.1002f9a6
mov dword [ebp - 0x8d4], edx
mov dword [ebp - 0x8dc], ecx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x8ac], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x8cc], eax
mov eax, dword [ebp + 0x18]
push 0x100389b8
push ebx
mov dword [ebp - 0x8a0], ebx
mov dword [ebp - 0x8a8], eax
call fcn.1001a1a1
pop ecx
pop ecx
test eax, eax
jne 0x1000a671
inc eax
jmp 0x1000b004
xor edi, edi
mov dword [ebp - 0x8b4], edi
mov dword [ebp - 0x8ec], edi
mov dword [ebp - 0x8e8], edi
mov dword [ebp - 0x8e4], edi
mov dword [ebp - 0x8e0], edi
lea edx, [ebp - 0x8ec]
mov dword [ebp - 4], edi
mov ecx, esi
call fcn.1001a1a1
test eax, eax
je 0x1000b000
xor esi, esi
inc esi
cmp dword [ebp - 0x8ec], esi
jb 0x1000b000
cmp dword [ebp + 0x1c], edi
jne 0x1000a6ca
cmp dword [ebp - 0x8ec], 0xc
jae 0x1000b002
push 4
pop edi
push 0x10038818
push ebx
call fcn.1001a1a1
pop ecx
pop ecx
test eax, eax
je 0x1000a700
push 0x100388a0
push ebx
call fcn.1001a1a1
pop ecx
pop ecx
test eax, eax
je 0x1000a700
push 0x10038934
push ebx
call fcn.1001a1a1
pop ecx
pop ecx
test eax, eax
jne 0x1000a703
push 0x32
pop edi
push dword [ebp - 0x8e8]
mov eax, 0x104
xor ebx, ebx
push dword [ebp - 0x8ec]
mov dword [ebp - 0x8d0], ebx
push str.SoftwareMicrosoftOffice_d._dCommonGeneral
push eax
lea eax, [ebp - 0x68c]
push eax
call fcn.1001a1a1
add esp, 0x14
lea eax, [ebp - 0x8d0]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x68c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x8d0], ebx
je 0x1000a7b3
lea eax, [ebp - 0x8bc]
mov dword [ebp - 0x8bc], 4
push eax
lea eax, [ebp - 0x8c0]
push eax
lea eax, [ebp - 0x8b8]
push eax
push ebx
push str.RecentTemplatesList
push dword [ebp - 0x8d0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000a7a7
cmp dword [ebp - 0x8b8], 4
jne 0x1000a7a7
cmp dword [ebp - 0x8c0], 0xff
cmovbe edi, dword [ebp - 0x8c0]
push dword [ebp - 0x8d0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x8a4], ebx
mov eax, edi
mov edx, 0x104
mul edx
push 2
seto cl
xor ebx, ebx
neg ecx
or eax, ecx
pop ecx
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.1001a1a1
mov dword [ebp - 0x8c4], eax
xor ebx, ebx
mov ecx, 0x104
mov eax, edi
mul ecx
push 2
pop edx
seto bl
xor ecx, ecx
neg ebx
or eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001a1a1
mov dword [ebp - 0x8c8], eax
xor ebx, ebx
mov ecx, 0x824
mov eax, edi
mul ecx
push 2
pop edx
seto bl
xor ecx, ecx
neg ebx
or eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001a1a1
mov dword [ebp - 0x8b8], eax
xor ebx, ebx
mov ecx, 0x824
mov eax, edi
mul ecx
push 2
pop edx
seto bl
xor ecx, ecx
neg ebx
or eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001a1a1
mov ebx, eax
add esp, 0x10
mov eax, dword [ebp - 0x8c4]
mov dword [ebp - 0x8c0], ebx
test eax, eax
je 0x1000afd5
cmp dword [ebp - 0x8c8], 0
je 0x1000afd5
cmp dword [ebp - 0x8b8], 0
je 0x1000afd5
test ebx, ebx
je 0x1000afd5
push 0x10039480
push dword [ebp - 0x8a0]
call fcn.1001a1a1
pop ecx
test eax, eax
mov eax, 0x104
pop ecx
je 0x1000a8e2
push dword [ebp - 0x8a8]
push dword [ebp - 0x8e8]
push dword [ebp - 0x8ec]
push str.SoftwareMicrosoftOffice_d._d_sRecent_Templates
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.1001a1a1
add esp, 0x18
jmp 0x1000a8f9
push 0xffffffffffffffff
push str.SoftwareMicrosoftFrontPageEditorRecent_Templates
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.1001a1a1
add esp, 0x10
lea eax, [ebp - 0x898]
xor ecx, ecx
push eax
push 3
push ecx
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x898], ecx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x898], 0
jne 0x1000a967
xor ecx, ecx
lea eax, [ebp - 0x898]
push ecx
push eax
push ecx
push 3
push ecx
push 0x10037e9c
push ecx
lea eax, [ebp - 0x27c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, dword [ebp - 0x898]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x898], ecx
test ecx, ecx
je 0x1000b002
test edi, edi
jle 0x1000abdf
mov ecx, dword [ebp - 0x8c8]
mov eax, esi
mov dword [ebp - 0x8a8], ebx
mov ebx, dword [ebp - 0x8c4]
sub ecx, ebx
mov dword [ebp - 0x8d8], ecx
mov ecx, dword [ebp - 0x8b8]
sub ecx, dword [ebp - 0x8c0]
mov dword [ebp - 0x8a0], eax
mov dword [ebp - 0x8bc], ecx
push eax
push str.Template_d
lea eax, [ebp - 0x74]
mov dword [ebp - 0x89c], esi
push 0x32
push eax
mov dword [ebp - 0x8b0], 0x208
call fcn.1001a1a1
add esp, 0x10
test eax, eax
je 0x1000abdf
lea eax, [ebp - 0x8b0]
push eax
push ebx
lea eax, [ebp - 0x89c]
push eax
xor eax, eax
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000abdf
push 2
pop eax
cmp dword [ebp - 0x89c], esi
je 0x1000aa10
cmp dword [ebp - 0x89c], eax
jne 0x1000abdf
cmp dword [ebp - 0x89c], eax
jne 0x1000aa50
mov eax, 0x104
push eax
lea eax, [ebp - 0x894]
push eax
push ebx
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
ja 0x1000aa50
test ebx, ebx
je 0x1000aa50
push 0xffffffffffffffff
lea eax, [ebp - 0x894]
push eax
mov eax, 0x104
push eax
push ebx
call fcn.1001a1a1
add esp, 0x10
push dword [ebp - 0x8a0]
lea eax, [ebp - 0x74]
mov dword [ebp - 0x89c], esi
push str.Friendly_d
push 0x32
push eax
mov dword [ebp - 0x8b0], 0x208
call fcn.1001a1a1
add esp, 0x10
test eax, eax
je 0x1000abdf
lea eax, [ebp - 0x8b0]
push eax
mov eax, dword [ebp - 0x8d8]
add eax, ebx
push eax
lea eax, [ebp - 0x89c]
push eax
xor eax, eax
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000abdf
cmp dword [ebp - 0x89c], esi
jne 0x1000abdf
push dword [ebp - 0x8a0]
lea eax, [ebp - 0x74]
mov dword [ebp - 0x89c], esi
push str.Thumbnail_d
push 0x32
push eax
mov dword [ebp - 0x8b0], 0x1048
call fcn.1001a1a1
add esp, 0x10
test eax, eax
je 0x1000ab26
lea eax, [ebp - 0x8b0]
push eax
mov eax, dword [ebp - 0x8a8]
add eax, dword [ebp - 0x8bc]
push eax
lea eax, [ebp - 0x89c]
push eax
xor eax, eax
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000ab26
cmp dword [ebp - 0x89c], esi
je 0x1000ab38
mov eax, dword [ebp - 0x8a8]
xor edx, edx
mov ecx, dword [ebp - 0x8bc]
mov word [ecx + eax], dx
push dword [ebp - 0x8a0]
lea eax, [ebp - 0x74]
mov dword [ebp - 0x89c], esi
push str.Preview_d
push 0x32
push eax
mov dword [ebp - 0x8b0], 0x1048
call fcn.1001a1a1
add esp, 0x10
test eax, eax
je 0x1000ab98
lea eax, [ebp - 0x8b0]
push eax
push dword [ebp - 0x8a8]
lea eax, [ebp - 0x89c]
push eax
xor eax, eax
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000ab98
cmp dword [ebp - 0x89c], esi
je 0x1000aba5
mov ecx, dword [ebp - 0x8a8]
xor eax, eax
mov word [ecx], ax
jmp 0x1000abab
mov ecx, dword [ebp - 0x8a8]
mov edx, dword [ebp - 0x8a4]
add ebx, 0x208
mov eax, dword [ebp - 0x8a0]
inc edx
inc eax
mov dword [ebp - 0x8a4], edx
add ecx, 0x1048
mov dword [ebp - 0x8a0], eax
mov dword [ebp - 0x8a8], ecx
cmp edx, edi
jl 0x1000a9a3
xor eax, eax
mov ebx, eax
cmp dword [ebp - 0x8a4], eax
jle 0x1000ac4b
mov eax, dword [ebp - 0x8c4]
lea edx, [edi - 1]
mov dword [ebp - 0x8bc], eax
cmp ebx, edx
jge 0x1000ac4b
push 0x2a
pop ecx
cmp cx, word [eax]
mov ecx, dword [ebp - 0x8a4]
jne 0x1000ac30
add eax, 2
push eax
push dword [ebp - 0x8dc]
call fcn.1001a1a1
pop ecx
pop ecx
test eax, eax
je 0x1000ac42
mov eax, dword [ebp - 0x8bc]
lea edx, [edi - 1]
mov ecx, dword [ebp - 0x8a4]
inc ebx
add eax, 0x208
mov dword [ebp - 0x8bc], eax
cmp ebx, ecx
jl 0x1000abfa
jmp 0x1000ac4b
lea edi, [ebx + 1]
mov dword [ebp - 0x8a4], edi
push dword [ebp - 0x8dc]
mov eax, 0x104
push 0x100395b8
push eax
lea eax, [ebp - 0x484]
push eax
call fcn.1001a1a1
lea ecx, [ebp - 0x484]
add esp, 0x10
lea edx, [ecx + 2]
xor ebx, ebx
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1000ac76
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x484]
push eax
push esi
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.Template1
push dword [ebp - 0x898]
call ebx
mov ecx, dword [ebp - 0x8d4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x8b4]
jne 0x1000acb2
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp - 0x8d4]
xor eax, eax
push esi
push eax
push str.Friendly1
push dword [ebp - 0x898]
call ebx
mov eax, dword [ebp - 0x8ac]
test eax, eax
je 0x1000ad2f
xor ecx, ecx
cmp word [eax], cx
je 0x1000ad2f
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x8b4]
jne 0x1000acfa
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
mov eax, dword [ebp - 0x8ac]
push eax
push esi
xor eax, eax
push eax
push str.Thumbnail1
push dword [ebp - 0x898]
call ebx
jmp 0x1000ad40
push str.Thumbnail1
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x8cc]
test eax, eax
je 0x1000ad8b
xor ecx, ecx
cmp word [eax], cx
je 0x1000ad8b
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x8b4]
jne 0x1000ad56
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
mov eax, dword [ebp - 0x8cc]
push eax
push esi
xor eax, eax
push eax
push str.Preview1
push dword [ebp - 0x898]
call ebx
jmp 0x1000ad9c
push str.Preview1
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x8a4]
inc eax
cmp eax, edi
cmovl edi, eax
lea eax, [edi - 1]
mov dword [ebp - 0x8cc], eax
test eax, eax
jle 0x1000af98
mov edx, dword [ebp - 0x8c8]
mov edi, dword [ebp - 0x8c0]
push 2
pop eax
mov ebx, eax
mov dword [ebp - 0x8a0], edx
mov eax, dword [ebp - 0x8c4]
sub eax, edx
mov dword [ebp - 0x8d8], eax
mov eax, dword [ebp - 0x8b8]
sub eax, edi
mov dword [ebp - 0x8d4], eax
push ebx
push str.Template_d
lea eax, [ebp - 0x74]
push 0x32
push eax
call fcn.1001a1a1
mov edx, dword [ebp - 0x8d8]
add esp, 0x10
add edx, dword [ebp - 0x8a0]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x8ac], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x8b4]
jne 0x1000ae17
sub ecx, dword [ebp - 0x8ac]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push esi
xor eax, eax
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
push str.Friendly_d
lea eax, [ebp - 0x74]
push 0x32
push eax
call fcn.1001a1a1
mov edx, dword [ebp - 0x8a0]
add esp, 0x10
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x8ac], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x8b4]
jne 0x1000ae70
sub ecx, dword [ebp - 0x8ac]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push esi
xor eax, eax
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
push str.Thumbnail_d
lea eax, [ebp - 0x74]
push 0x32
push eax
call fcn.1001a1a1
mov edx, dword [ebp - 0x8d4]
xor eax, eax
add edx, edi
add esp, 0x10
cmp word [edx], ax
je 0x1000af08
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x8ac], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x8b4]
jne 0x1000aed2
sub ecx, dword [ebp - 0x8ac]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push esi
xor eax, eax
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1000af18
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push ebx
push str.Preview_d
lea eax, [ebp - 0x74]
push 0x32
push eax
call fcn.1001a1a1
xor eax, eax
add esp, 0x10
cmp word [edi], ax
je 0x1000af6a
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x8b4]
jne 0x1000af38
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push esi
xor eax, eax
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1000af7a
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add dword [ebp - 0x8a0], 0x208
add edi, 0x1048
inc ebx
sub dword [ebp - 0x8cc], 1
jne 0x1000adec
push dword [ebp - 0x8c4]
call fcn.1001a1a1
push dword [ebp - 0x8c8]
call fcn.1001a1a1
push dword [ebp - 0x8b8]
call fcn.1001a1a1
push dword [ebp - 0x8c0]
call fcn.1001a1a1
add esp, 0x10
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000b002
push eax
call fcn.1001a1a1
push dword [ebp - 0x8c8]
call fcn.1001a1a1
push dword [ebp - 0x8b8]
call fcn.1001a1a1
push ebx
call fcn.1001a1a1
add esp, 0x10
xor eax, eax
mov esi, eax
jmp 0x1000b002
mov esi, edi
mov eax, esi
call fcn.1002f958
ret 0x18