Function at 0x42fb03
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x854
push esi
xor esi, esi
mov word [eax], si
mov eax, dword [ebp + 0xc]
mov word [eax], si
lea eax, [ebp - 8]
push eax
push 8
push esi
push str.SoftwareMicrosoftOffice
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42fb3d
xor al, al
jmp 0x42fd47
push ebx
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x23c]
push eax
push esi
push dword [ebp - 8]
mov ebx, 0x104
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x42fd35
push edi
inc dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x23c]
push str._d.0
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], esi
call fcn.0044056d
add esp, 0xc
cmp eax, 1
jne 0x42fd11
mov eax, dword [ebp - 0x1c]
cmp eax, 0xf
jl 0x42fd11
cmp eax, dword [ebp - 0x20]
jle 0x42fd11
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x854]
push str._sOutlookProfilesOutlook
push eax
call fcn.00401000
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 8
push esi
lea eax, [ebp - 0x854]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42fd11
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x444]
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], ebx
push esi
jmp 0x42fcef
inc dword [ebp - 0xc]
or dword [ebp - 0x34], 0xffffffff
lea eax, [ebp - 0x30]
push eax
push 1
push esi
lea eax, [ebp - 0x444]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42fcdd
push 4
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
pop edi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push str.ED475418_B0D6_11D2_8C3B_00104B2A6676
push dword [ebp - 0x30]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42fc65
cmp dword [ebp - 0x24], 3
jne 0x42fc65
cmp dword [ebp - 0x2c], edi
mov edi, dword [ebp - 0x28]
je 0x42fc68
mov edi, dword [ebp - 0x34]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 0xffffffff
je 0x42fcdd
push edi
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x64c]
push str._s_08u
push eax
call fcn.00401000
mov edi, dword [ebp + 8]
add esp, 0x10
push 0x459720
push str.SMTP_Server
lea eax, [ebp - 0x64c]
push eax
push dword [ebp - 4]
mov eax, edi
call fcn.00401071
test al, al
je 0x42fcd4
push 0x459720
push str.Email
lea eax, [ebp - 0x64c]
push eax
push dword [ebp - 4]
mov eax, dword [ebp + 0xc]
call fcn.00401071
test al, al
jne 0x42fd02
mov eax, dword [ebp + 0xc]
mov word [eax], si
mov word [edi], si
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x444]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x42fc02
jmp 0x42fd08
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x18]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x42fb6e
pop edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 0x20], esi
pop ebx
setg al
pop esi
leave
ret 8