Function at 0x40e120
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4014
call fcn.004010b0
mov eax, dword [0x423b1c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x800
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x3014], ecx
push 0
push eax
call fcn.00401027
push 0x800
lea eax, [ebp - 0x2004]
push 0
push eax
call fcn.00401027
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x3008]
add esp, 0x18
push eax
push 0xf003f
push 0
push 0x4200c8
push connect
call ebx
test eax, eax
jne 0x40e194
push str.SoftwareMicrosoftOffice15.0OutlookProfilesOutlook9375CFF0413111d3B88A00104B2A6676
jmp 0x40e205
lea eax, [ebp - 0x3008]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows_Messaging_SubsystemProfilesOutlook9375CFF0413111d3B88A00104B2A6676
push connect
call ebx
test eax, eax
jne 0x40e1b9
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows_Messaging_SubsystemProfilesOutlook9375CFF0413111d3B88A00104B2A6676
jmp 0x40e205
lea eax, [ebp - 0x3008]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindows_Messaging_SubsystemProfiles9375CFF0413111d3B88A00104B2A6676
push connect
call ebx
test eax, eax
jne 0x40e1de
push str.SoftwareMicrosoftWindows_Messaging_SubsystemProfiles9375CFF0413111d3B88A00104B2A6676
jmp 0x40e205
lea eax, [ebp - 0x3008]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftOffice16.0OutlookProfilesOutlook9375CFF0413111d3B88A00104B2A6676
push connect
call ebx
test eax, eax
jne 0x40e354
push str.SoftwareMicrosoftOffice16.0OutlookProfilesOutlook9375CFF0413111d3B88A00104B2A6676
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x1004]
push eax
call edi
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x300c]
push eax
lea eax, [ebp - 0x3010]
push eax
push 0
push 0
push 0
push dword [ebp - 0x3008]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x40e354
xor esi, esi
cmp dword [ebp - 0x3010], esi
jbe 0x40e33e
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x300c]
mov dword [ebp - 0x300c], 0x800
push eax
lea eax, [ebp - 0x3004]
push eax
push esi
push dword [ebp - 0x3008]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x40e354
push dword [ebp - 0x3008]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x2004]
push eax
call edi
push 0x41f414
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x3004]
push eax
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x3008]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x2004]
push eax
push connect
call ebx
test eax, eax
jne 0x40e354
mov ecx, dword [ebp - 0x3014]
lea eax, [ebp - 0x4014]
push eax
push dword [ebp - 0x3008]
call fcn.0040dcb0
push dword [ebp - 0x3008]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x3008]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x1004]
push eax
push connect
call ebx
test eax, eax
jne 0x40e354
inc esi
cmp esi, dword [ebp - 0x3010]
jb 0x40e256
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
mov esp, ebp
pop ebp
ret