Function at 0x428110
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x49be18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [0x4cc854]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov ebx, 3
push str.SoftwareMicrosoftInternet_Account_Manager
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], bl
call fcn.0048c58c
push str.ExamAcctA
lea ecx, [esp + 0xc]
call fcn.0048c58c
push 1
push ecx
lea eax, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.0048c178
push ecx
mov byte [esp + 0x3c], 4
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Default_Mail_Account
call fcn.0048c471
push ecx
lea edx, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
mov byte [esp + 0x44], 5
call fcn.0048c178
push reloc.WS2_32.dll_accept
mov ecx, esi
mov byte [esp + 0x44], bl
call fcn.004288e0
push str.SoftwareMicrosoftInternet_Account_ManagerAccounts
lea ecx, [esp + 0x14]
call fcn.0048c58c
push eax
lea ecx, [esp + 0x14]
call fcn.0048c53c
push 0x41
lea eax, [esp + 0xc]
push str.ExamAcct_c
push eax
call fcn.0048a7fc
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push 0x4c2288
push ecx
push edx
call fcn.0048c698
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push eax
push edx
mov byte [esp + 0x3c], 6
call fcn.0048c632
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 7
call fcn.0048c53c
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 6
call fcn.0048c403
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], bl
call fcn.0048c403
push ecx
lea eax, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.0048c178
push reloc.WS2_32.dll_accept
mov ecx, esi
call fcn.00428be0
push 1
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.0048c178
push ecx
mov byte [esp + 0x3c], 8
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Account_Name
call fcn.0048c471
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x44], 9
call fcn.0048c178
push reloc.WS2_32.dll_accept
mov ecx, esi
mov byte [esp + 0x44], bl
call fcn.004288e0
push 1
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.0048c178
push ecx
mov byte [esp + 0x3c], 0xa
mov ecx, esp
mov dword [esp + 0x28], esp
push str.POP3_User_Name
call fcn.0048c471
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x44], 0xb
call fcn.0048c178
push reloc.WS2_32.dll_accept
mov ecx, esi
mov byte [esp + 0x44], bl
call fcn.004288e0
push 1
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.0048c178
push ecx
mov byte [esp + 0x3c], 0xc
mov ecx, esp
mov dword [esp + 0x28], esp
push str.SMTP_Display_Name
call fcn.0048c471
mov byte [esp + 0x3c], 0xd
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0048c178
push reloc.WS2_32.dll_accept
mov ecx, esi
mov byte [esp + 0x44], bl
call fcn.004288e0
lea ecx, [esp + 8]
push str._163.com
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.0048c698
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 0xe
call fcn.0048c53c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], bl
call fcn.0048c403
push 1
push ecx
lea eax, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0048c178
push ecx
mov byte [esp + 0x3c], 0xf
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SMTP_Email_Address
call fcn.0048c471
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov byte [esp + 0x44], 0x10
call fcn.0048c178
push reloc.WS2_32.dll_accept
mov ecx, esi
mov byte [esp + 0x44], bl
call fcn.004288e0
push 0x4d0e20
lea ecx, [esp + 0xc]
call fcn.0048c58c
push 1
push ecx
lea eax, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0048c178
push ecx
mov byte [esp + 0x3c], 0x11
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.SMTP_User_Name
call fcn.0048c471
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
mov byte [esp + 0x44], 0x12
call fcn.0048c178
push reloc.WS2_32.dll_accept
mov ecx, esi
mov byte [esp + 0x44], bl
call fcn.004288e0
push ebx
push 0x4c2da4
lea eax, [esp + 0x10]
push eax
call fcn.0048a7fc
add esp, 0xc
lea edx, [esp + 8]
push 4
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.0048c178
push ecx
mov byte [esp + 0x3c], 0x13
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Connection_Type
call fcn.0048c471
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x44], 0x14
call fcn.0048c178
push reloc.WS2_32.dll_accept
mov ecx, esi
mov byte [esp + 0x44], bl
call fcn.004288e0
push 0
lea ecx, [esp + 0xc]
push 0x4c2da4
push ecx
call fcn.0048a7fc
add esp, 0xc
lea edx, [esp + 8]
push 4
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.0048c178
push ecx
mov byte [esp + 0x3c], 0x15
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.POP3_Prompt_for_Password
call fcn.0048c471
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x44], 0x16
call fcn.0048c178
push reloc.WS2_32.dll_accept
mov ecx, esi
mov byte [esp + 0x44], bl
call fcn.004288e0
push 4
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.0048c178
push ecx
mov byte [esp + 0x3c], 0x17
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.SMTP_Prompt_for_Password
call fcn.0048c471
push ecx
mov byte [esp + 0x40], 0x18
mov ecx, esp
mov dword [esp + 0x28], esp
lea eax, [esp + 0x1c]
push eax
call fcn.0048c178
push reloc.WS2_32.dll_accept
mov ecx, esi
mov byte [esp + 0x44], bl
call fcn.004288e0
push str.127.0.0.1
lea ecx, [esp + 0xc]
call fcn.0048c58c
push 1
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.0048c178
push ecx
mov byte [esp + 0x3c], 0x19
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.POP3_Server
call fcn.0048c471
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x44], 0x1a
call fcn.0048c178
push reloc.WS2_32.dll_accept
mov ecx, esi
mov byte [esp + 0x44], bl
call fcn.004288e0
push 1
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.0048c178
push ecx
mov byte [esp + 0x3c], 0x1b
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.SMTP_Server
call fcn.0048c471
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x44], 0x1c
call fcn.0048c178
push reloc.WS2_32.dll_accept
mov ecx, esi
mov byte [esp + 0x44], bl
call fcn.004288e0
push 0
lea ecx, [esp + 0xc]
push 0x4c2da4
push ecx
call fcn.0048a7fc
add esp, 0xc
lea edx, [esp + 8]
push 4
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.0048c178
push ecx
mov byte [esp + 0x3c], 0x1d
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.POP3_Skip_Account
call fcn.0048c471
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x44], 0x1e
call fcn.0048c178
push reloc.WS2_32.dll_accept
mov ecx, esi
mov byte [esp + 0x44], bl
call fcn.004288e0
push 2
lea ecx, [esp + 0xc]
push 0x4c2da4
push ecx
call fcn.0048a7fc
add esp, 0xc
lea edx, [esp + 8]
push 4
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.0048c178
push ecx
mov byte [esp + 0x3c], 0x1f
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.SMTP_Use_Sicily
call fcn.0048c471
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x44], 0x20
call fcn.0048c178
push reloc.WS2_32.dll_accept
mov ecx, esi
mov byte [esp + 0x44], bl
call fcn.004288e0
push 0
lea ecx, [esp + 0xc]
push 0x4c2da4
push ecx
call fcn.0048a7fc
add esp, 0xc
lea edx, [esp + 8]
push 4
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.0048c178
push ecx
mov byte [esp + 0x3c], 0x21
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Leave_Mail_On_Server
call fcn.0048c471
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x44], 0x22
call fcn.0048c178
push reloc.WS2_32.dll_accept
mov ecx, esi
mov byte [esp + 0x44], bl
call fcn.004288e0
push 0x6e
lea ecx, [esp + 0xc]
push 0x4c2da4
push ecx
call fcn.0048a7fc
add esp, 0xc
lea edx, [esp + 8]
push 4
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.0048c178
push ecx
mov byte [esp + 0x3c], 0x23
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.POP3_Port
call fcn.0048c471
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x44], 0x24
call fcn.0048c178
push reloc.WS2_32.dll_accept
mov ecx, esi
mov byte [esp + 0x44], bl
call fcn.004288e0
push 0x19
lea ecx, [esp + 0xc]
push 0x4c2da4
push ecx
call fcn.0048a7fc
add esp, 0xc
lea edx, [esp + 8]
push 4
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.0048c178
push ecx
mov byte [esp + 0x3c], 0x25
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.SMTP_Port
call fcn.0048c471
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x44], 0x26
call fcn.0048c178
push reloc.WS2_32.dll_accept
mov ecx, esi
mov byte [esp + 0x44], bl
call fcn.004288e0
push 0x3c
lea ecx, [esp + 0xc]
push 0x4c2da4
push ecx
call fcn.0048a7fc
add esp, 0xc
lea edx, [esp + 8]
push 4
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.0048c178
push ecx
mov byte [esp + 0x3c], 0x27
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.POP3_Timeout
call fcn.0048c471
mov byte [esp + 0x3c], 0x28
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0048c178
push reloc.WS2_32.dll_accept
mov ecx, esi
mov byte [esp + 0x44], bl
call fcn.004288e0
push 4
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.0048c178
push ecx
mov byte [esp + 0x3c], 0x29
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.SMTP_Timeout
call fcn.0048c471
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x44], 0x2a
call fcn.0048c178
push reloc.WS2_32.dll_accept
mov ecx, esi
mov byte [esp + 0x44], bl
call fcn.004288e0
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 2
call fcn.0048c403
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 1
call fcn.0048c403
lea ecx, [esp + 8]
mov byte [esp + 0x30], 0
call fcn.0048c403
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0xffffffff
call fcn.0048c403
mov ecx, dword [esp + 0x28]
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret 8