Function at 0x2a8385c3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30c
mov eax, 0x2a8d205b
call fcn.2a85a9c0
xor ebx, ebx
push ebx
call fcn.2a83ed5f
pop ecx
cmp eax, 4
jne 0x2a8388ac
cmp word [0x2a91fbb0], bx
jne 0x2a8388c3
push 6
pop ecx
mov esi, str.SoftwareMicrosoftOffice_
lea edi, [ebp - 0x1bc]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x111
lea eax, [ebp - 0x1a1]
push ebx
push eax
mov dword [ebp - 0x2ec], ebx
mov byte [ebp - 0x90], bl
mov byte [ebp - 0x2e8], bl
movsb byte es:[edi], byte [esi]
call sub.MSVCR100.dll_memset
mov esi, 0x12c
add esp, 0xc
mov dword [ebp - 0x2fc], esi
mov dword [ebp - 0x2f8], 0x80
mov dword [ebp - 0x2f4], ebx
mov dword [ebp - 0x300], ebx
mov dword [ebp - 0x304], ebx
mov dword [ebp - 0x308], ebx
mov dword [ebp - 0x30c], ebx
mov dword [ebp - 0x318], ebx
lea eax, [ebp - 0x2ec]
push eax
push 0x101
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsOUTLOOK.EXE
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x2a83877f
lea eax, [ebp - 0x2fc]
push eax
lea eax, [ebp - 0x2e8]
push eax
lea eax, [ebp - 0x2f4]
push eax
push ebx
push ebx
push dword [ebp - 0x2ec]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2a83889e
lea eax, [ebp - 0x2e8]
push eax
lea ecx, [ebp - 0x318]
call fcn.2a83ed5f
mov edi, dword [sym.imp.MSVCR100.dll__set_invalid_parameter_handler]
push fcn.2a80a412
mov byte [ebp - 0x2f0], bl
call edi
push 0xa
push 3
lea eax, [ebp - 0x2f0]
push eax
push dword [ebp - 0x30c]
call dword [sym.imp.MSVCR100.dll__itoa_s]
push ebx
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x1bc]
push esi
push eax
call fcn.2a83ed5f
push ebx
push 0x2a8d3d34
lea eax, [ebp - 0x1bc]
push esi
push eax
call fcn.2a83ed5f
push fcn.2a80a412
call edi
push 0xa
push 3
lea eax, [ebp - 0x2f0]
push eax
push dword [ebp - 0x308]
call dword [sym.imp.MSVCR100.dll__itoa_s]
add esp, 0x48
push ebx
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x1bc]
push esi
push eax
call fcn.2a83ed5f
push ebx
push str.Outlook
lea eax, [ebp - 0x1bc]
push esi
push eax
call fcn.2a83ed5f
add esp, 0x20
push dword [ebp - 0x2ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2ec], ebx
mov edi, reloc.OLEAUT32.dll_SysReAllocString
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x2ec]
push eax
push 1
push ebx
lea eax, [ebp - 0x1bc]
push eax
push edi
call esi
test eax, eax
jne 0x2a8387fb
lea eax, [ebp - 0x2f8]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x2f4]
push eax
push ebx
push str.Bitness
push dword [ebp - 0x2ec]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2a8387ef
lea eax, [ebp - 0x90]
push 0x2a8d6480
push eax
call fcn.2a83ed5f
pop ecx
pop ecx
test eax, eax
jne 0x2a8387e6
inc eax
mov word [0x2a91fbac], ax
xor eax, eax
inc eax
mov word [0x2a91fbb0], ax
push dword [ebp - 0x2ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [0x2a91fbb0], bx
jne 0x2a838883
lea eax, [ebp - 0x2f0]
push eax
push 0x101
push ebx
lea eax, [ebp - 0x1bc]
push eax
push edi
mov dword [ebp - 0x2f0], ebx
call esi
test eax, eax
jne 0x2a838877
lea eax, [ebp - 0x2f8]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x2f4]
push eax
push ebx
push str.Bitness
push dword [ebp - 0x2f0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2a838877
lea eax, [ebp - 0x90]
push 0x2a8d6480
push eax
call fcn.2a83ed5f
pop ecx
pop ecx
test eax, eax
jne 0x2a83886e
inc eax
mov word [0x2a91fbac], ax
xor eax, eax
inc eax
mov word [0x2a91fbb0], ax
push dword [ebp - 0x2f0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x318], ebx
je 0x2a8388c3
push dword [ebp - 0x318]
call dword [sym.imp.MSVCR100.dll_free]
pop ecx
jmp 0x2a8388c3
push dword [ebp - 0x2ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x2a8388c3
cmp word [0x2a91fbac], bx
je 0x2a8388c3
xor eax, eax
mov word [0x2a91fbac], ax
mov word [0x2a91fbb0], ax
mov ax, word [0x2a91fbac]
call fcn.2a85aa2f
ret