Function at 0x414a90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
lea eax, [esp + 8]
lea ecx, [esp + 4]
push ebx
push ebp
push esi
push edi
push eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push ecx
push 0
push 0xf003f
push 0
push 0x429560
push 0
push str.Software_vp_eyePhoto_Cards
push closesocket
call ebp
test eax, eax
je 0x414ad1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x10]
mov edi, 0x80
push edx
push 0x430ce0
push 0
push 0
push str.MailServer
push eax
mov dword [esp + 0x28], edi
call esi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0x435f40
push 0
push 0
push str.UserAccount
push edx
mov dword [esp + 0x28], edi
call esi
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push 0x435ec0
push 0
push 0
push str.UserName
push ecx
mov dword [esp + 0x28], edi
call esi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 0x430d80
push 0
push 0
push str.FromAdr
push eax
mov dword [esp + 0x28], edi
call esi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0x4305d8
push 0
push 0
push str.UserPassword
push edx
mov dword [esp + 0x28], 0xc8
call esi
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push 0x4305d4
push 0
push 0
push str.CheckPassword
push ecx
mov dword [esp + 0x28], 4
call esi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 0x430c40
push 0
push 0
push str.ToAdr
push eax
mov dword [esp + 0x28], edi
call esi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0x4306a0
push 0
push 0
push str.MailMode
mov dword [esp + 0x24], 1
push edx
call esi
mov eax, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push 0xf003f
push 0
push 0x429560
push 0
push str.Software_vp_eye_video_recorder
push closesocket
call ebp
test eax, eax
je 0x414c19
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov al, byte [0x430ce0]
test al, al
jne 0x414c40
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push 0x430ce0
push 0
push 0
push str.MailServer
push ecx
mov dword [esp + 0x28], edi
call esi
mov al, byte [0x435f40]
test al, al
jne 0x414c67
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 0x435f40
push 0
push 0
push str.UserAccount
push eax
mov dword [esp + 0x28], edi
call esi
mov al, byte [0x435ec0]
test al, al
jne 0x414c8e
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0x435ec0
push 0
push 0
push str.UserName
push edx
mov dword [esp + 0x28], edi
call esi
mov al, byte [0x430d80]
test al, al
jne 0x414cb7
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], edi
push eax
xor edi, edi
push 0x430d80
push edi
push edi
push str.FromAdr
push ecx
call esi
jmp 0x414cb9
xor edi, edi
mov edx, dword [esp + 0x14]
push edx
call ebx
lea eax, [esp + 0x18]
lea ecx, [esp + 0x14]
push eax
push ecx
push edi
push 0xf003f
push edi
push 0x429560
push edi
push str.SOFTWAREMicrosoftWindows_Messaging_Subsystem
push closesocket
call ebp
test eax, eax
je 0x414cf7
mov dword [0x4306a4], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push edi
push edi
mov ebp, 5
push str.MAPI
push ecx
mov dword [esp + 0x28], ebp
call esi
test eax, eax
je 0x414d36
mov edx, dword [esp + 0x14]
mov dword [0x4306a4], edi
push edx
call ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
push ecx
push edi
push edi
push str.MAPIX
push edx
mov dword [esp + 0x28], ebp
call esi
test eax, eax
je 0x414d70
mov eax, dword [esp + 0x14]
mov dword [0x4306a4], edi
push eax
call ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret
mov cl, byte [esp + 0x1c]
mov al, 0x31
cmp cl, al
jne 0x414d8c
mov cl, byte [esp + 0x24]
mov dword [0x4306a4], 1
cmp cl, al
je 0x414d92
mov dword [0x4306a4], edi
mov ecx, dword [esp + 0x14]
push ecx
call ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret