Function at 0x413760
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x478
mov ecx, 0x1d4c
xor eax, eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
mov edi, 0x440cb8
rep stosd dword es:[edi], eax
lea eax, [esp + 0x160]
push str.SoftwareMicrosoftInternet_Account_ManagerAccounts
push eax
call ebp
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x160]
push ecx
push 0xf003f
push 0
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x413a0b
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 3
lea eax, [esp + 0x30]
lea ecx, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x24]
push 0
push 0
push 0
lea edx, [esp + 0x308]
push ecx
mov ecx, dword [esp + 0x38]
push edx
push eax
push ecx
mov dword [esp + 0x4c], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x168]
push str.SoftwareMicrosoftInternet_Account_ManagerAccounts
push edx
mov dword [esp + 0x30], eax
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x168]
push 0x439230
push eax
call esi
lea ecx, [esp + 0x2f8]
lea edx, [esp + 0x168]
push ecx
push edx
call esi
lea eax, [esp + 0x18]
lea ecx, [esp + 0x168]
push eax
push 0xf003f
push 0
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x38]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
mov esi, 0x96
push str.POP3_User_Name
push edx
mov dword [esp + 0x28], esi
call ebx
test eax, eax
jne 0x4139f1
lea eax, [esp + 0x38]
push eax
mov eax, dword [0x4482f4]
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
lea edx, [ecx*8 + 0x440cb8]
push edx
call ebp
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x38]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x38]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push 0
push str.POP3_Server
push eax
mov dword [esp + 0x28], esi
call ebx
call sub.MFC42u.DLL_AfxGetEmptyString
mov ecx, dword [eax]
lea edx, [esp + 0x38]
mov dword [esp + 0x1c], ecx
push edx
lea ecx, [esp + 0x20]
call fcn.00424244
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [0x4482f4]
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
lea edx, [ecx*8 + 0x440e48]
push edx
call ebp
lea ecx, [esp + 0x1c]
call sub.MFC42u.DLL_CString::CString
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x38]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
lea ecx, [esp + 0xd0]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push 0
push str.POP3_Password2
push eax
mov dword [esp + 0x28], esi
call ebx
test eax, eax
jne 0x4139d2
mov eax, dword [esp + 0x10]
mov edi, 2
xor esi, esi
cmp eax, edi
jbe 0x4139d2
mov edx, dword [0x4482f4]
cmp esi, 0x64
jge 0x4139c7
movzx cx, byte [esp + edi + 0xd0]
push ecx
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
mov edx, dword [0x4482f4]
test eax, eax
jne 0x413993
mov al, byte [esp + edi + 0xd0]
cmp al, 0x28
je 0x413993
cmp al, 0x29
je 0x413993
cmp al, 0x2e
je 0x413993
cmp al, 0x20
je 0x413993
cmp al, 0x2d
jne 0x4139b1
movzx cx, byte [esp + edi + 0xd0]
lea eax, [edx + edx*2]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [esi + eax*4]
inc esi
mov word [eax*2 + 0x440d80], cx
lea eax, [edx + edx*2]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
lea eax, [esi + ecx*4]
mov word [eax*2 + 0x440d80], 0
mov eax, dword [esp + 0x10]
inc edi
cmp edi, eax
jb 0x413959
jmp 0x4139d8
mov edx, dword [0x4482f4]
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0xd0]
inc edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [0x4482f4], edx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
inc ecx
cmp eax, 0x103
mov dword [esp + 0x20], ecx
jne 0x4137c6
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x478
ret