Function at 0x1001911a
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x10022599
call fcn.10021c80
mov eax, 0x2034
call fcn.10021d20
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x20]
call fcn.100024c5
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
push str.SOFTWARE
lea ecx, [ebp - 0x20]
call fcn.100027f9
push str.Public_DomainBlat
lea ecx, [ebp - 0x20]
call fcn.100026bf
cmp dword [ebp + 0xc], 0
je 0x10019184
mov eax, dword [ebp + 0xc]
movzx eax, word [eax]
test eax, eax
je 0x10019184
push 0x1002e61c
lea ecx, [ebp - 0x20]
call fcn.100026bf
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
call fcn.100026bf
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x20]
call fcn.1000272e
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x2030], eax
lea ecx, [ebp - 0x20]
call fcn.10002525
cmp dword [ebp - 0x2030], 0
je 0x10019212
cmp dword [ebp + 0xc], 0
je 0x100191f1
mov eax, dword [ebp + 0xc]
movzx eax, word [eax]
test eax, eax
je 0x100191f1
push 0
push dword [ebp + 8]
call fcn.1001911a
pop ecx
pop ecx
mov dword [ebp - 0x2038], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.100024a2
mov eax, dword [ebp - 0x2038]
jmp 0x10019a3b
mov dword [ebp - 0x203c], 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.100024a2
mov eax, dword [ebp - 0x203c]
jmp 0x10019a3b
mov dword [ebp - 0x2034], pe_nt_image_headers32
lea eax, [ebp - 0x2034]
push eax
lea eax, [ebp - 0x202c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.Sender
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2030], eax
cmp dword [ebp - 0x2034], 0
je 0x10019269
cmp dword [ebp - 0x2030], 0
jne 0x10019269
lea eax, [ebp - 0x202c]
push eax
mov ecx, 0x10041188
call fcn.100027f9
jmp 0x10019273
mov ecx, 0x10041188
call fcn.100024e5
mov dword [ebp - 0x2034], pe_nt_image_headers32
lea eax, [ebp - 0x2034]
push eax
lea eax, [ebp - 0x202c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1002e290
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2030], eax
cmp dword [ebp - 0x2034], 0
je 0x100192cd
cmp dword [ebp - 0x2030], 0
jne 0x100192cd
lea eax, [ebp - 0x202c]
push eax
push 0x10041630
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
jmp 0x100192df
push 0x10024474
push 0x10041630
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
mov dword [ebp - 0x2034], 0x1003
lea eax, [ebp - 0x2034]
push eax
lea eax, [ebp - 0x202c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.Login
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2030], eax
cmp dword [ebp - 0x2034], 0
je 0x10019364
cmp dword [ebp - 0x2030], 0
jne 0x10019364
mov ecx, 0x100411a8
call fcn.100024e5
mov eax, dword [ebp - 0x2034]
shl eax, 2
push eax
mov ecx, 0x100411a8
call fcn.100025da
mov ecx, 0x100411a8
call fcn.1000272e
push eax
lea eax, [ebp - 0x202c]
push eax
call fcn.10002bc0
pop ecx
pop ecx
mov ecx, 0x100411a8
call fcn.10005be7
mov dword [ebp - 0x2034], 0x1003
lea eax, [ebp - 0x2034]
push eax
lea eax, [ebp - 0x202c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1002e278
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2030], eax
cmp dword [ebp - 0x2034], 0
je 0x100193e9
cmp dword [ebp - 0x2030], 0
jne 0x100193e9
mov ecx, 0x10037608
call fcn.100024e5
mov eax, dword [ebp - 0x2034]
shl eax, 2
push eax
mov ecx, 0x10037608
call fcn.100025da
mov ecx, 0x10037608
call fcn.1000272e
push eax
lea eax, [ebp - 0x202c]
push eax
call fcn.10002bc0
pop ecx
pop ecx
mov ecx, 0x10037608
call fcn.10005be7
mov dword [ebp - 0x2034], pe_nt_image_headers32
lea eax, [ebp - 0x2034]
push eax
lea eax, [ebp - 0x202c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.SMTP_server
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2030], eax
cmp dword [ebp - 0x2034], 0
je 0x100194b8
cmp dword [ebp - 0x2030], 0
jne 0x100194b8
lea eax, [ebp - 0x202c]
push eax
push 0x100373f4
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
mov dword [ebp - 0x2034], pe_nt_image_headers32
lea eax, [ebp - 0x2034]
push eax
lea eax, [ebp - 0x202c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.SMTP_Port
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2030], eax
cmp dword [ebp - 0x2034], 0
je 0x100194a3
cmp dword [ebp - 0x2030], 0
jne 0x100194a3
lea eax, [ebp - 0x202c]
push eax
push 0x10035470
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
jmp 0x100194b6
push dword [0x1003436c]
push 0x10035470
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
jmp 0x100194c8
and word [0x100373f4], 0
and word [0x10035470], 0
mov dword [ebp - 0x2034], pe_nt_image_headers32
lea eax, [ebp - 0x2034]
push eax
lea eax, [ebp - 0x202c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.NNTP_server
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2030], eax
cmp dword [ebp - 0x2034], 0
je 0x10019597
cmp dword [ebp - 0x2030], 0
jne 0x10019597
lea eax, [ebp - 0x202c]
push eax
push 0x10041b10
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
mov dword [ebp - 0x2034], pe_nt_image_headers32
lea eax, [ebp - 0x2034]
push eax
lea eax, [ebp - 0x202c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.NNTP_Port
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2030], eax
cmp dword [ebp - 0x2034], 0
je 0x10019582
cmp dword [ebp - 0x2030], 0
jne 0x10019582
lea eax, [ebp - 0x202c]
push eax
push 0x10037628
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
jmp 0x10019595
push dword [0x10034368]
push 0x10037628
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
jmp 0x100195a7
and word [0x10041b10], 0
and word [0x10037628], 0
mov dword [ebp - 0x2034], pe_nt_image_headers32
lea eax, [ebp - 0x2034]
push eax
lea eax, [ebp - 0x202c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.POP3_server
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2030], eax
cmp dword [ebp - 0x2034], 0
je 0x100197a2
cmp dword [ebp - 0x2030], 0
jne 0x100197a2
lea eax, [ebp - 0x202c]
push eax
push 0x10035904
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
mov dword [ebp - 0x2034], pe_nt_image_headers32
lea eax, [ebp - 0x2034]
push eax
lea eax, [ebp - 0x202c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.POP3_Port
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2030], eax
cmp dword [ebp - 0x2034], 0
je 0x10019661
cmp dword [ebp - 0x2030], 0
jne 0x10019661
lea eax, [ebp - 0x202c]
push eax
push 0x10040f70
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
jmp 0x10019674
push dword [0x10034370]
push 0x10040f70
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
mov dword [ebp - 0x2034], 0x1003
lea eax, [ebp - 0x2034]
push eax
lea eax, [ebp - 0x202c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.POP3_Login
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2030], eax
cmp dword [ebp - 0x2034], 0
je 0x100196fb
cmp dword [ebp - 0x2030], 0
jne 0x100196fb
mov ecx, 0x10035898
call fcn.100024e5
mov eax, dword [ebp - 0x2034]
shl eax, 2
push eax
mov ecx, 0x10035898
call fcn.100025da
mov ecx, 0x10035898
call fcn.1000272e
push eax
lea eax, [ebp - 0x202c]
push eax
call fcn.10002bc0
pop ecx
pop ecx
mov ecx, 0x10035898
call fcn.10005be7
jmp 0x1001970a
push 0x100411a8
mov ecx, 0x10035898
call fcn.1000255c
mov dword [ebp - 0x2034], 0x1003
lea eax, [ebp - 0x2034]
push eax
lea eax, [ebp - 0x202c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.POP3_Pwd
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2030], eax
cmp dword [ebp - 0x2034], 0
je 0x10019791
cmp dword [ebp - 0x2030], 0
jne 0x10019791
mov ecx, 0x10041178
call fcn.100024e5
mov eax, dword [ebp - 0x2034]
shl eax, 2
push eax
mov ecx, 0x10041178
call fcn.100025da
mov ecx, 0x10041178
call fcn.1000272e
push eax
lea eax, [ebp - 0x202c]
push eax
call fcn.10002bc0
pop ecx
pop ecx
mov ecx, 0x10041178
call fcn.10005be7
jmp 0x100197a0
push 0x10037608
mov ecx, 0x10041178
call fcn.1000255c
jmp 0x100197b2
and word [0x10035904], 0
and word [0x10040f70], 0
mov dword [ebp - 0x2034], pe_nt_image_headers32
lea eax, [ebp - 0x2034]
push eax
lea eax, [ebp - 0x202c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.IMAP_server
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2030], eax
cmp dword [ebp - 0x2034], 0
je 0x100199ad
cmp dword [ebp - 0x2030], 0
jne 0x100199ad
lea eax, [ebp - 0x202c]
push eax
push 0x1003716c
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
mov dword [ebp - 0x2034], pe_nt_image_headers32
lea eax, [ebp - 0x2034]
push eax
lea eax, [ebp - 0x202c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.IMAP_Port
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2030], eax
cmp dword [ebp - 0x2034], 0
je 0x1001986c
cmp dword [ebp - 0x2030], 0
jne 0x1001986c
lea eax, [ebp - 0x202c]
push eax
push 0x10034e40
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
jmp 0x1001987f
push dword [0x10034374]
push 0x10034e40
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
mov dword [ebp - 0x2034], 0x1003
lea eax, [ebp - 0x2034]
push eax
lea eax, [ebp - 0x202c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.IMAP_Login
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2030], eax
cmp dword [ebp - 0x2034], 0
je 0x10019906
cmp dword [ebp - 0x2030], 0
jne 0x10019906
mov ecx, 0x10035d10
call fcn.100024e5
mov eax, dword [ebp - 0x2034]
shl eax, 2
push eax
mov ecx, 0x10035d10
call fcn.100025da
mov ecx, 0x10035d10
call fcn.1000272e
push eax
lea eax, [ebp - 0x202c]
push eax
call fcn.10002bc0
pop ecx
pop ecx
mov ecx, 0x10035d10
call fcn.10005be7
jmp 0x10019915
push 0x100411a8
mov ecx, 0x10035d10
call fcn.1000255c
mov dword [ebp - 0x2034], 0x1003
lea eax, [ebp - 0x2034]
push eax
lea eax, [ebp - 0x202c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.IMAP_Pwd
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2030], eax
cmp dword [ebp - 0x2034], 0
je 0x1001999c
cmp dword [ebp - 0x2030], 0
jne 0x1001999c
mov ecx, 0x10041870
call fcn.100024e5
mov eax, dword [ebp - 0x2034]
shl eax, 2
push eax
mov ecx, 0x10041870
call fcn.100025da
mov ecx, 0x10041870
call fcn.1000272e
push eax
lea eax, [ebp - 0x202c]
push eax
call fcn.10002bc0
pop ecx
pop ecx
mov ecx, 0x10041870
call fcn.10005be7
jmp 0x100199ab
push 0x10037608
mov ecx, 0x10041870
call fcn.1000255c
jmp 0x100199bd
and word [0x1003716c], 0
and word [0x10034e40], 0
cmp dword [ebp - 0x14], 0
je 0x100199cc
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], 0xc
mov ecx, 0x10041188
call fcn.1000272e
movzx eax, word [eax]
test eax, eax
je 0x10019a20
movzx eax, word [0x100373f4]
test eax, eax
je 0x100199f3
and dword [ebp - 0x24], 0
movzx eax, word [0x10035904]
test eax, eax
je 0x10019a02
and dword [ebp - 0x24], 0
movzx eax, word [0x1003716c]
test eax, eax
je 0x10019a11
and dword [ebp - 0x24], 0
movzx eax, word [0x10041b10]
test eax, eax
je 0x10019a20
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2040], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.100024a2
mov eax, dword [ebp - 0x2040]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret