Function at 0x140058a00
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
mov r15, r9
mov edx, 2
mov r14, r8
mov rdi, rcx
call fcn.140058000
mov ebx, eax
test eax, eax
js 0x140058ca2
and dword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
and dword [rbp - 0xc], 0
lea r9, [rbp - 8]
mov qword [rsp + 0x28], rax
lea rdx, str.Server
and qword [rsp + 0x20], 0
add rdi, 0x30
xor r8d, r8d
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140058a7b
xor ecx, ecx
jmp 0x140058a96
mov eax, dword [rbp - 8]
dec eax
cmp eax, 1
jbe 0x140058a8c
mov eax, InitCommonControls
jmp 0x140058ad9
mov ecx, dword [rbp - 0x10]
shr ecx, 1
mov dword [rbp - 0xc], ecx
xor eax, eax
test eax, eax
jne 0x140058ad9
mov edx, ecx
mov rcx, rsi
inc rdx
call fcn.1400416c0
test al, al
je 0x140058ab4
mov r8, qword [rsi + 0x108]
jmp 0x140058ab7
xor r8d, r8d
test r8, r8
jne 0x140058ac2
lea eax, [r8 + 0xe]
jmp 0x140058ad9
lea r9, [rbp - 0xc]
mov rcx, rdi
lea rdx, str.Server
call fcn.140059110
test eax, eax
je 0x140058aea
movzx ebx, ax
mov esi, 0x80070000
or ebx, esi
test eax, eax
cmovle ebx, eax
jmp 0x140058aef
mov esi, 0x80070000
test ebx, ebx
js 0x140058ca2
mov rcx, qword [rdi]
lea rax, [rbp - 0xc]
and dword [rbp - 0xc], 0
lea r9, [rbp - 8]
and dword [rbp - 0x10], 0
lea rdx, str.MailTo
mov qword [rsp + 0x28], rax
xor r8d, r8d
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140058b33
xor ecx, ecx
jmp 0x140058b4e
mov eax, dword [rbp - 8]
dec eax
cmp eax, 1
jbe 0x140058b44
mov eax, InitCommonControls
jmp 0x140058b91
mov ecx, dword [rbp - 0xc]
shr ecx, 1
mov dword [rbp - 0x10], ecx
xor eax, eax
test eax, eax
jne 0x140058b91
mov edx, ecx
mov rcx, r14
inc rdx
call fcn.1400416c0
test al, al
je 0x140058b6c
mov r8, qword [r14 + 0x108]
jmp 0x140058b6f
xor r8d, r8d
test r8, r8
jne 0x140058b7a
lea eax, [r8 + 0xe]
jmp 0x140058b91
lea r9, [rbp - 0x10]
mov rcx, rdi
lea rdx, str.MailTo
call fcn.140059110
test eax, eax
je 0x140058b9b
movzx ebx, ax
or ebx, esi
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140058ca2
mov rcx, qword [rdi]
lea rax, [rbp - 0xc]
and dword [rbp - 0xc], 0
lea r9, [rbp - 8]
and dword [rbp - 0x10], 0
lea rdx, str.MailFrom
mov qword [rsp + 0x28], rax
xor r8d, r8d
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140058bdf
xor ecx, ecx
jmp 0x140058bfa
mov eax, dword [rbp - 8]
dec eax
cmp eax, 1
jbe 0x140058bf0
mov eax, InitCommonControls
jmp 0x140058c3d
mov ecx, dword [rbp - 0xc]
shr ecx, 1
mov dword [rbp - 0x10], ecx
xor eax, eax
test eax, eax
jne 0x140058c3d
mov edx, ecx
mov rcx, r15
inc rdx
call fcn.1400416c0
test al, al
je 0x140058c18
mov r8, qword [r15 + 0x108]
jmp 0x140058c1b
xor r8d, r8d
test r8, r8
jne 0x140058c26
lea eax, [r8 + 0xe]
jmp 0x140058c3d
lea r9, [rbp - 0x10]
mov rcx, rdi
lea rdx, str.MailFrom
call fcn.140059110
test eax, eax
je 0x140058c47
movzx ebx, ax
or ebx, esi
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140058ca2
mov rcx, qword [rdi]
lea rax, [rbp - 8]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0xc]
mov rax, qword [rbp + 0x40]
lea rdx, str.Port
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rbp - 8], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140058c98
cmp dword [rbp - 0xc], 4
je 0x140058c92
mov eax, InitCommonControls
jmp 0x140058c98
xor eax, eax
test eax, eax
je 0x140058ca2
movzx ebx, ax
or ebx, esi
test eax, eax
cmovle ebx, eax
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret