Function at 0x2a837f22
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0x5b4
mov eax, 0x2a8d1fb4
call fcn.2a85a9f6
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x5b4], eax
mov dword [ebp - 0x5bc], ecx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x198], bl
mov byte [ebp - 0x94], bl
cmp eax, ebx
je 0x2a837f57
mov byte [eax], bl
push str.MAPI32.DLL
call fcn.2a809316
mov esi, eax
mov dword [ebp - 0x5b8], esi
cmp esi, ebx
je 0x2a838252
push str.FGetComponentPath
push esi
mov dword [ebp - 0x5a4], ebx
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebp - 0x5c0], eax
cmp eax, ebx
je 0x2a8381e1
lea eax, [ebp - 0x5a4]
push eax
push 1
push ebx
mov esi, str.SoftwareClientsMail
push esi
mov edi, 0x80
push SysReAllocString
mov dword [ebp - 0x5b0], edi
mov dword [ebp - 0x5a8], ebx
mov dword [ebp - 0x5ac], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x2a838031
lea eax, [ebp - 0x5b0]
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x5a8]
push eax
push ebx
push ebx
push dword [ebp - 0x5a4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x2a837ff8
mov dword [ebp - 0x5ac], 1
push dword [ebp - 0x5a4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x5a4], ebx
cmp word [ebp - 0x5ac], bx
je 0x2a838031
cmp dword [ebp - 0x5a8], 1
jne 0x2a838031
push ebx
lea eax, [ebp - 0x94]
push edi
push eax
call fcn.2a808482
add esp, 0xc
cmp eax, ebx
ja 0x2a838094
lea eax, [ebp - 0x5a4]
push eax
push 1
push ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x5b0], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x2a838094
lea eax, [ebp - 0x5b0]
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x5a8]
push eax
push ebx
push ebx
push dword [ebp - 0x5a4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x2a838082
mov dword [ebp - 0x5ac], 1
push dword [ebp - 0x5a4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x5a4], ebx
cmp word [ebp - 0x5ac], bx
je 0x2a8380bf
cmp dword [ebp - 0x5a8], 1
jne 0x2a8380bf
push ebx
lea eax, [ebp - 0x94]
push edi
push eax
call fcn.2a808482
add esp, 0xc
cmp eax, ebx
ja 0x2a83820e
push ebx
push str.SoftwareClientsMail_
mov esi, 0x200
lea eax, [ebp - 0x49c]
push esi
push eax
call fcn.2a808482
add esp, 0x10
push ebx
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x49c]
push esi
push eax
call fcn.2a808482
add esp, 0x10
lea eax, [ebp - 0x5a4]
push eax
push 1
push ebx
lea eax, [ebp - 0x49c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x2a83820e
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x5ac]
push eax
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x5a8]
push eax
push ebx
push str.MSIComponentID
push dword [ebp - 0x5a4]
mov esi, 0x104
mov dword [ebp - 0x5ac], esi
call edi
cmp eax, ebx
jne 0x2a83816a
cmp dword [ebp - 0x5a8], 4
jne 0x2a8381cd
push ebx
push esi
lea eax, [ebp - 0x198]
push eax
push ebx
push eax
call dword [ebp - 0x5c0]
jmp 0x2a8381cd
lea eax, [ebp - 0x5ac]
push eax
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x5a8]
push eax
push ebx
push str.DLLPath
push dword [ebp - 0x5a4]
call edi
cmp eax, ebx
jne 0x2a8381cd
cmp dword [ebp - 0x5a8], 2
jne 0x2a8381cd
push esi
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x198]
push eax
mov byte [ebp - 0x29c], bl
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsA]
push ebx
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x198]
push esi
push eax
call fcn.2a808482
add esp, 0x10
push dword [ebp - 0x5a4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x5a4], ebx
jmp 0x2a83820e
push ebx
push str.Mapi32
lea eax, [ebp - 0x94]
push 0x80
push eax
call fcn.2a808482
add esp, 0x10
push 0x104
lea eax, [ebp - 0x5a0]
push eax
push esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
push dword [ebp - 0x5b8]
call dword [sym.imp.kernel32.dll_FreeLibrary]
cmp dword [ebp - 0x5b4], ebx
je 0x2a83823c
movzx eax, word [ebp + 0xc]
push eax
lea eax, [ebp - 0x94]
push eax
push dword [ebp - 0x5b4]
call fcn.2a808482
add esp, 0xc
mov ecx, dword [ebp - 0x5bc]
cmp ecx, ebx
je 0x2a838252
lea eax, [ebp - 0x198]
push eax
call fcn.2a808482
call fcn.2a85aa3e
ret