Function at 0x10009cab
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 8], ebx
je 0x10009cfe
cmp byte [edi], bl
je 0x10009cfe
mov esi, str.SOFTWAREPublic_DomainBlat
push esi
call sub.MSVCRT.dll_strlen
push edi
mov dword [ebp - 0x10], eax
call sub.MSVCRT.dll_strlen
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax + 2]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push dword [ebp + 0xc]
mov edi, eax
push esi
push str._s_s
push edi
call sub.MSVCRT.dll_sprintf
add esp, 0x1c
jmp 0x10009d1c
mov esi, str.SOFTWAREPublic_DomainBlat
push esi
call sub.MSVCRT.dll_strlen
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
push esi
push edi
call sub.MSVCRT.dll_strcpy
add esp, 0x10
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
mov esi, eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
cmp esi, ebx
pop ecx
je 0x10009d60
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x10009d58
cmp byte [eax], bl
je 0x10009d58
push ebx
push dword [ebp + 8]
call fcn.10009cab
pop ecx
pop ecx
jmp 0x1000a137
push 0xc
pop eax
jmp 0x1000a137
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
push 0x1001cdd0
lea eax, [ebp - 0xc]
push eax
push ebx
push str.Sender
push dword [ebp - 8]
mov edi, 0x100
mov dword [ebp - 4], edi
call esi
lea eax, [ebp - 4]
push eax
push 0x1001d520
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x10017644
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10009db6
push 0x100137dc
push 0x1001d520
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.Login
push dword [ebp - 8]
mov dword [ebp - 4], 0x203
call esi
cmp dword [ebp - 4], ebx
je 0x10009df5
cmp eax, ebx
jne 0x10009df5
lea eax, [ebp - 0x214]
push 0x1001e068
push eax
call fcn.10010da4
pop ecx
pop ecx
jmp 0x10009dfb
mov byte [0x1001e068], bl
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x10017638
push dword [ebp - 8]
mov dword [ebp - 4], 0x203
call esi
cmp dword [ebp - 4], ebx
je 0x10009e3a
cmp eax, ebx
jne 0x10009e3a
lea eax, [ebp - 0x214]
push 0x10023d28
push eax
call fcn.10010da4
pop ecx
pop ecx
jmp 0x10009e40
mov byte [0x10023d28], bl
lea eax, [ebp - 4]
push eax
push 0x1001d628
lea eax, [ebp - 0xc]
push eax
push ebx
push str.SMTP_server
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
test eax, eax
jne 0x10009e92
lea eax, [ebp - 4]
push eax
push 0x1001eaa8
lea eax, [ebp - 0xc]
push eax
push ebx
push str.SMTP_Port
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10009e9e
push dword [0x1001caf4]
push 0x1001eaa8
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
jmp 0x10009e9e
mov byte [0x1001d628], bl
mov byte [0x1001eaa8], bl
lea eax, [ebp - 4]
push eax
push 0x1001d840
lea eax, [ebp - 0xc]
push eax
push ebx
push str.NNTP_server
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
test eax, eax
jne 0x10009ef0
lea eax, [ebp - 4]
push eax
push 0x1001e280
lea eax, [ebp - 0xc]
push eax
push ebx
push str.NNTP_Port
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10009efc
push dword [0x1001caf0]
push 0x1001e280
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
jmp 0x10009efc
mov byte [0x1001d840], bl
mov byte [0x1001e280], bl
lea eax, [ebp - 4]
push eax
push 0x1001d418
lea eax, [ebp - 0xc]
push eax
push ebx
push str.POP3_server
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
test eax, eax
jne 0x10009ff0
lea eax, [ebp - 4]
push eax
push 0x1001e490
lea eax, [ebp - 0xc]
push eax
push ebx
push str.POP3_Port
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10009f50
push dword [0x1001caf8]
push 0x1001e490
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.POP3_Login
push dword [ebp - 8]
mov dword [ebp - 4], 0x203
call esi
cmp dword [ebp - 4], ebx
je 0x10009f8f
cmp eax, ebx
jne 0x10009f8f
lea eax, [ebp - 0x214]
push 0x1001e9a0
push eax
call fcn.10010da4
pop ecx
pop ecx
jmp 0x10009f9f
push 0x1001e068
push 0x1001e9a0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.POP3_Pwd
push dword [ebp - 8]
mov dword [ebp - 4], 0x203
call esi
cmp dword [ebp - 4], ebx
je 0x10009fde
cmp eax, ebx
jne 0x10009fde
lea eax, [ebp - 0x214]
push 0x10023818
push eax
call fcn.10010da4
pop ecx
pop ecx
jmp 0x10009ffc
push 0x10023d28
push 0x10023818
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x10009ffc
mov byte [0x1001d418], bl
mov byte [0x1001e490], bl
lea eax, [ebp - 4]
push eax
push 0x1001f3b8
lea eax, [ebp - 0xc]
push eax
push ebx
push str.IMAP_server
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
test eax, eax
jne 0x1000a0ea
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], edi
mov edi, 0x10024048
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
push str.IMAP_Port
push dword [ebp - 8]
call esi
test eax, eax
je 0x1000a04d
push dword [0x1001cafc]
push edi
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.IMAP_Login
push dword [ebp - 8]
mov edi, 0x203
mov dword [ebp - 4], edi
call esi
cmp dword [ebp - 4], ebx
je 0x1000a08d
cmp eax, ebx
jne 0x1000a08d
lea eax, [ebp - 0x214]
push 0x10023710
push eax
call fcn.10010da4
pop ecx
pop ecx
jmp 0x1000a09d
push 0x1001e068
push 0x10023710
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.IMAP_Pwd
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
cmp dword [ebp - 4], ebx
je 0x1000a0d8
cmp eax, ebx
jne 0x1000a0d8
lea eax, [ebp - 0x214]
push 0x1001e388
push eax
call fcn.10010da4
pop ecx
pop ecx
jmp 0x1000a0f6
push 0x10023d28
push 0x1001e388
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1000a0f6
mov byte [0x1001f3b8], bl
mov byte [0x10024048], bl
cmp dword [ebp - 8], ebx
je 0x1000a104
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x1001cdd0], bl
push 0xc
pop eax
je 0x1000a137
cmp byte [0x1001d628], bl
je 0x1000a119
xor eax, eax
cmp byte [0x1001d418], bl
je 0x1000a123
xor eax, eax
cmp byte [0x1001f3b8], bl
je 0x1000a12d
xor eax, eax
cmp byte [0x1001d840], bl
je 0x1000a137
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret