Function at 0x416671
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1618
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x1608]
push ecx
push 0x20019
push ebx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4166b6
xor eax, eax
jmp 0x41692a
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1610]
push eax
lea eax, [ebp - 0x1604]
mov dword [ebp - 0x1610], 0x400
push eax
lea eax, [ebp - 0x160c]
mov byte [ebp - 0x1604], bl
push eax
push ebx
push str.EmailAddress
push dword [ebp - 0x1608]
call esi
test eax, eax
jne 0x41691c
lea eax, [ebp - 0x1618]
mov byte [ebp - 0x80c], bl
push eax
lea eax, [ebp - 0x1204]
mov byte [ebp - 0xc0c], bl
push eax
lea eax, [ebp - 0x160c]
mov byte [ebp - 0x1204], bl
push eax
push ebx
push str.PopAccount
push dword [ebp - 0x1608]
mov byte [ebp - 0x40c], bl
mov dword [ebp - 0x1618], 0x400
call esi
lea eax, [ebp - 0x1614]
mov dword [ebp - 0x1614], 0x400
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x160c]
push eax
push ebx
push str.PopPassword
push dword [ebp - 0x1608]
call esi
lea eax, [ebp - 0x1610]
mov dword [ebp - 0x1610], 0x400
push eax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x160c]
push eax
push ebx
push str.PopServer
push dword [ebp - 0x1608]
call esi
mov edx, dword [ebp - 0x1614]
test edx, edx
je 0x416826
cmp dword [ebp - 0x1618], ebx
jbe 0x416826
lea eax, [ebp - 0xc0c]
push eax
lea ecx, [ebp - 0x80c]
call fcn.0041662d
lea eax, [ebp - 0x40c]
mov dword [esp], str.imap
push eax
call fcn.00639500
test eax, eax
mov edx, str.IMAP
mov ecx, str.POP3
lea eax, [ebp - 0xe04]
cmovne ecx, edx
push ecx
push 0x1f4
push eax
call fcn.006494f3
add esp, 0x14
lea eax, [ebp - 0xc0c]
mov ecx, edi
push 0xffffffffffffffff
push 0x6c5bb9
push eax
lea eax, [ebp - 0x1604]
push eax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0xe04]
push eax
push 0xfe
push 2
call fcn.0043ee6b
lea eax, [ebp - 0x1618]
mov byte [ebp - 0x80c], bl
push eax
lea eax, [ebp - 0x1204]
mov byte [ebp - 0xc0c], bl
push eax
lea eax, [ebp - 0x160c]
mov byte [ebp - 0x1204], bl
push eax
push ebx
push str.SmtpAccount
push dword [ebp - 0x1608]
mov byte [ebp - 0x40c], bl
mov dword [ebp - 0x1618], 0x400
call esi
lea eax, [ebp - 0x1614]
mov dword [ebp - 0x1614], 0x400
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x160c]
push eax
push ebx
push str.SmtpPassword
push dword [ebp - 0x1608]
call esi
lea eax, [ebp - 0x1610]
mov dword [ebp - 0x1610], 0x400
push eax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x160c]
push eax
push ebx
push str.SmtpServer
push dword [ebp - 0x1608]
call esi
mov edx, dword [ebp - 0x1614]
test edx, edx
je 0x416919
cmp dword [ebp - 0x1618], ebx
jbe 0x416919
lea eax, [ebp - 0xc0c]
push eax
lea ecx, [ebp - 0x80c]
call fcn.0041662d
pop ecx
push 0xffffffffffffffff
push 0x6c5bb9
lea eax, [ebp - 0xc0c]
mov ecx, edi
push eax
lea eax, [ebp - 0x1604]
push eax
lea eax, [ebp - 0x40c]
push eax
push str.SMTP
push 0xfe
push 2
call fcn.0043ee6b
xor ebx, ebx
inc ebx
push dword [ebp - 0x1608]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 4