Function at 0x140014b20
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x400
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rsp + 0x430], rbx
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
mov r12, rdx
mov rsi, rcx
xor ebx, ebx
mov byte [rcx], bl
mov byte [rdx], bl
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0xd0]
call fcn.14010da60
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x40], rdx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareQualcommEudoraCommandLine
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140014de6
mov dword [rsp + 0x54], 1
mov dword [rsp + 0x60], 0x208
mov byte [rsp + 0x1e0], al
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
xor r8d, r8d
lea rdx, str.Current
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140014dda
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1e0]
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x140014dda
mov rax, qword [str.eudora.ini]
mov qword [rsp + 0x98], rax
movzx eax, word [0x1401ecaa8]
mov word [rsp + 0xa0], ax
movzx eax, byte [0x1401ecaaa]
mov byte [rsp + 0xa2], al
lea rcx, [rsp + 0x1e0]
call fcn.140115670
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x1e0]
call fcn.14010d30c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140014cd7
nop
lea rcx, [rsp + 0x1e0]
cmp rax, rcx
je 0x140014c9c
cmp byte [rax], 0x20
je 0x140014c9c
dec rax
mov qword [rsp + 0x58], rax
jmp 0x140014c80
mov byte [rax], 0x20
inc rax
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0x70], rcx
movzx edx, byte [rax]
test dl, dl
je 0x140014cd4
cmp dl, 0x20
je 0x140014cd4
mov byte [rcx], dl
inc rcx
mov qword [rsp + 0x70], rcx
inc rax
mov qword [rsp + 0x58], rax
jmp 0x140014cb4
mov byte [rcx], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xd0]
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x140014dda
mov rax, qword [str.Settings]
mov qword [rsp + 0x88], rax
movzx eax, byte [0x1401eca98]
mov byte [rsp + 0x90], al
mov rax, qword [str.SMTPServer]
mov qword [rsp + 0xa8], rax
movzx eax, word [0x1401eca88]
mov word [rsp + 0xb0], ax
movzx eax, byte [0x1401eca8a]
mov byte [rsp + 0xb2], al
mov rax, qword [str.ReturnAddress]
mov qword [rsp + 0xb8], rax
mov eax, dword [0x1401eca78]
mov dword [rsp + 0xc0], eax
movzx eax, word [0x1401eca7c]
mov word [rsp + 0xc4], ax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
mov r9, rsi
lea r8, [0x14024d112]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rdx, [rsp + 0xd0]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x104
mov r9, r12
lea r8, [0x14024d112]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, 1
mov dword [rsp + 0x50], ebx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov eax, ebx
jmp 0x140014dee
mov rcx, qword [rsp + 0x3f0]
xor rcx, rsp
call fcn.14010d170
mov rbx, qword [rsp + 0x430]
add rsp, 0x400
pop r12
pop rdi
pop rsi
ret