Function at 0x1000eb0d
Capabilities:
Create directory
Get common file path
Move file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24c8
call fcn.1002fb29
mov eax, dword [0x100400b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x24b4], eax
xor ebx, ebx
cmp dword [ebp + 0x10], 8
mov eax, dword [ebp + 0x1c]
push esi
mov dword [ebp - 0x24c8], eax
mov eax, dword [ebp + 0x24]
push edi
mov dword [ebp - 0x24c0], edx
mov dword [ebp - 0x24bc], ecx
mov dword [ebp - 0x24c4], eax
mov dword [ebp - 0x24ac], 0x208
mov dword [ebp - 0x24b0], ebx
mov dword [ebp - 0x24a8], ebx
jbe 0x1000ecb9
push ebx
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1000eca3
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1000eb92
sub ecx, edx
mov edi, 0x104
sar ecx, 1
push 0x5c
pop ebx
cmp bx, word [ebp + ecx*2 - 0x20e]
je 0x1000ebd3
push 0xffffffffffffffff
push 0x100393f0
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.1001a3af
add esp, 0x10
cmp eax, 0x50
je 0x1000eca3
push str.MicrosoftTemplates
mov edx, edi
lea ecx, [ebp - 0x20c]
call fcn.1001a3af
test eax, eax
je 0x1000eca3
xor esi, esi
xor eax, eax
inc esi
cmp ax, word [ebp - 0x20c]
je 0x1000ec97
lea eax, [ebp - 0x20c]
push 0x10039374
push eax
call fcn.1001de79
pop ecx
pop ecx
test eax, eax
jne 0x1000eca3
lea eax, [ebp - 0x20c]
push 0x100396a4
push eax
call fcn.1001de79
pop ecx
pop ecx
test eax, eax
jne 0x1000eca3
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.1001ddb2
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x1000ec9b
push 0x3a
pop edi
cmp di, word [ebx - 2]
je 0x1000ec78
xor eax, eax
xor esi, esi
mov word [ebx], ax
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
jne 0x1000ec75
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1000ec78
xor esi, esi
inc esi
push 0x5c
pop eax
push eax
mov word [ebx], ax
lea eax, [ebx + 2]
push eax
call fcn.1001ddb2
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x1000ec49
mov edi, 0x104
jmp 0x1000ec9b
xor eax, eax
mov esi, eax
test esi, esi
jne 0x1000ee7a
mov eax, 0x80041003
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001c65c
leave
ret 0x20
jne 0x1000eca3
lea eax, [ebp - 0x24a8]
push eax
push 0x20019
push ebx
push str.SoftwareMicrosoftOffice8.0CommonFileNewLocalTemplates
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
mov edi, 0x104
push 0x5c
inc ebx
pop esi
test eax, eax
jne 0x1000ee5d
lea eax, [ebp - 0x24ac]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x24b8]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x24a8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000ee5d
cmp dword [ebp - 0x24b8], ebx
jne 0x1000ee5d
mov eax, dword [ebp - 0x24ac]
cmp eax, 2
jb 0x1000ee5d
shr eax, 1
xor ecx, ecx
cmp word [ebp + eax*2 - 0x20e], cx
jne 0x1000ee5d
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x24b0]
jne 0x1000ed4e
sub ecx, edx
sar ecx, 1
cmp si, word [ebp + ecx*2 - 0x20e]
je 0x1000ed8b
push 0xffffffffffffffff
push 0x100393f0
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.1001a3af
add esp, 0x10
cmp eax, 0x50
je 0x1000ee5d
push str.Presentation_Designs_
mov edx, edi
lea ecx, [ebp - 0x20c]
call fcn.1001a3af
test eax, eax
je 0x1000ee5d
xor eax, eax
cmp ax, word [ebp - 0x20c]
je 0x1000ee4e
lea eax, [ebp - 0x20c]
push 0x10039374
push eax
call fcn.1001de79
pop ecx
pop ecx
test eax, eax
jne 0x1000ee5a
lea eax, [ebp - 0x20c]
push 0x100396a4
push eax
call fcn.1001de79
pop ecx
pop ecx
test eax, eax
jne 0x1000ee5a
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.1001ddb2
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1000ee4a
push 0x3a
pop edi
cmp di, word [esi - 2]
je 0x1000ee2d
xor eax, eax
xor ebx, ebx
mov word [esi], ax
lea eax, [ebp - 0x20c]
push ebx
push eax
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
jne 0x1000ee2a
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1000ee2d
xor ebx, ebx
inc ebx
push 0x5c
pop eax
push eax
mov word [esi], ax
lea eax, [esi + 2]
push eax
call fcn.1001ddb2
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1000edfe
mov edi, 0x104
xor eax, eax
jmp 0x1000ee52
xor eax, eax
mov ebx, eax
test ebx, ebx
je 0x1000ee5a
mov ebx, eax
jmp 0x1000ee5d
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x24a8], 0
je 0x1000ee72
push dword [ebp - 0x24a8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1000eca3
mov ebx, dword [ebp - 0x24bc]
test ebx, ebx
je 0x1000ef36
mov eax, dword [ebp - 0x24b4]
test eax, eax
je 0x1000ef25
xor ecx, ecx
cmp cx, word [eax]
je 0x1000ef25
push ecx
push eax
mov edx, edi
lea ecx, [ebp - 0x414]
call fcn.1001a3af
test eax, eax
je 0x1000ef25
lea eax, [ebp - 0x414]
push 0x28
push eax
call fcn.1001ddb2
pop ecx
pop ecx
test eax, eax
je 0x1000eee8
lea ecx, [ebp - 0x414]
cmp eax, ecx
je 0x1000eee3
push 0x20
pop ecx
cmp cx, word [eax - 2]
jne 0x1000eee3
xor ecx, ecx
mov word [eax - 2], cx
jmp 0x1000eee8
xor ecx, ecx
mov word [eax], cx
xor eax, eax
cmp ax, word [ebp - 0x414]
je 0x1000ef25
push 0x2e
push ebx
call fcn.1001a3af
pop ecx
pop ecx
mov esi, eax
lea ecx, [ebp - 0x414]
xor eax, eax
mov edx, edi
push eax
call fcn.1001a3af
test eax, eax
je 0x1000ef25
push esi
mov edx, edi
lea ecx, [ebp - 0x414]
call fcn.1001a3af
test eax, eax
jne 0x1000ef40
push ecx
push ebx
mov edx, edi
lea ecx, [ebp - 0x414]
call fcn.1001a3af
jmp 0x1000ef38
xor eax, eax
test eax, eax
je 0x1000eca3
lea eax, [ebp - 0x24b4]
push eax
push ecx
lea eax, [ebp - 0x20c]
push eax
push str..POT
mov edx, eax
lea ecx, [ebp - 0x414]
call fcn.1001a3af
test eax, eax
je 0x1000eca3
mov esi, 0x1048
xor eax, eax
push esi
push eax
lea eax, [ebp - 0x145c]
push eax
call fcn.1001e894
push esi
xor esi, esi
lea eax, [ebp - 0x24a4]
push esi
push eax
call fcn.1001e894
mov edx, dword [ebp - 0x24c0]
add esp, 0x18
test edx, edx
je 0x1000f013
test ebx, ebx
je 0x1000f013
mov esi, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, word [ebp - 0x24b0]
jne 0x1000efa4
sub esi, ecx
lea eax, [ebp - 0x414]
sar esi, 1
cmp edx, eax
je 0x1000efd4
push ecx
push edx
mov edx, edi
mov ecx, eax
call fcn.1001a3af
test eax, eax
je 0x1000eca3
push 0x5c
pop eax
cmp ax, word [ebp + esi*2 - 0x416]
je 0x1000f001
push 0xffffffffffffffff
push 0x100393f0
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.1001a3af
add esp, 0x10
cmp eax, 0x50
je 0x1000eca3
push ebx
mov edx, edi
lea ecx, [ebp - 0x414]
call fcn.1001a3af
xor esi, esi
jmp 0x1000f015
mov eax, esi
test eax, eax
je 0x1000eca3
xor eax, eax
cmp ax, word [ebp - 0x414]
je 0x1000f0fa
cmp ax, word [ebp - 0x20c]
je 0x1000f0fa
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.1001a3af
pop ecx
pop ecx
test eax, eax
je 0x1000f104
mov esi, dword [ebp - 0x24c4]
test esi, esi
je 0x1000f0be
call fcn.1001a3af
test eax, eax
je 0x1000f0be
xor eax, eax
lea ecx, [ebp - 0x414]
mov word [ebp - 0x145c], ax
mov word [ebp - 0x24a4], ax
call fcn.1001a3af
test eax, eax
lea eax, [ebp - 0x24a4]
push ecx
je 0x1000f099
push eax
push ecx
lea ecx, [ebp - 0x414]
jmp 0x1000f0e9
push ecx
push eax
push ecx
lea eax, [ebp - 0x145c]
push eax
push esi
lea edx, [ebp - 0x20c]
lea ecx, [ebp - 0x414]
call fcn.1001a3af
xor ecx, ecx
test eax, eax
setns cl
jmp 0x1000f0f6
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.kernel32.dll_MoveFileW]
test eax, eax
je 0x1000eca3
push ecx
lea eax, [ebp - 0x24a4]
push eax
push ecx
lea ecx, [ebp - 0x20c]
lea edx, [ebp - 0x145c]
call fcn.1001a3af
mov ecx, eax
xor esi, esi
jmp 0x1000f0fc
mov ecx, esi
test ecx, ecx
je 0x1000eca3
push dword [ebp + 0x20]
lea eax, [ebp - 0x145c]
mov ecx, 0x10039824
push dword [ebp - 0x24c8]
lea edx, [ebp - 0x24a4]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push esi
call fcn.1001a3af
jmp 0x1000eca8