Function at 0x408cbf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 8], ebx
je 0x408d13
cmp byte [edi], bl
je 0x408d13
mov esi, str.SOFTWAREPublic_DomainBlat
push esi
call sub.MSVCRT.dll_strlen
push edi
mov dword [ebp - 0x10], eax
call sub.MSVCRT.dll_strlen
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax + 2]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push dword [ebp + 0xc]
mov edi, eax
push esi
push str._s_s
push edi
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x1c
jmp 0x408d31
mov esi, str.SOFTWAREPublic_DomainBlat
push esi
call sub.MSVCRT.dll_strlen
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
push esi
push edi
call sub.MSVCRT.dll_strcpy
add esp, 0x10
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
mov esi, eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
cmp esi, ebx
pop ecx
je 0x408d75
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x408d6d
cmp byte [eax], bl
je 0x408d6d
push ebx
push dword [ebp + 8]
call fcn.00408cbf
pop ecx
pop ecx
jmp 0x409042
push 0xc
pop eax
jmp 0x409042
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
push 0x41ab48
lea eax, [ebp - 0xc]
push eax
push ebx
push str.Sender
push dword [ebp - 8]
mov edi, 0x100
mov dword [ebp - 4], edi
call esi
lea eax, [ebp - 4]
push eax
push 0x41b298
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x415e08
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x408dcb
push 0x4127c4
push 0x41b298
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.Login
push dword [ebp - 8]
mov dword [ebp - 4], 0x203
call esi
cmp dword [ebp - 4], ebx
je 0x408e0a
cmp eax, ebx
jne 0x408e0a
lea eax, [ebp - 0x214]
push 0x41bde0
push eax
call fcn.0040f324
pop ecx
pop ecx
jmp 0x408e10
mov byte [0x41bde0], bl
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x415dfc
push dword [ebp - 8]
mov dword [ebp - 4], 0x203
call esi
cmp dword [ebp - 4], ebx
je 0x408e4f
cmp eax, ebx
jne 0x408e4f
lea eax, [ebp - 0x214]
push 0x421790
push eax
call fcn.0040f324
pop ecx
pop ecx
jmp 0x408e55
mov byte [0x421790], bl
lea eax, [ebp - 4]
push eax
push 0x41b3a0
lea eax, [ebp - 0xc]
push eax
push ebx
push str.SMTP_server
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
test eax, eax
jne 0x408ea7
lea eax, [ebp - 4]
push eax
push 0x41c718
lea eax, [ebp - 0xc]
push eax
push ebx
push str.SMTP_Port
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x408eb3
push dword [0x41a868]
push 0x41c718
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
jmp 0x408eb3
mov byte [0x41b3a0], bl
mov byte [0x41c718], bl
lea eax, [ebp - 4]
push eax
push 0x41b5b8
lea eax, [ebp - 0xc]
push eax
push ebx
push str.NNTP_server
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
test eax, eax
jne 0x408f05
lea eax, [ebp - 4]
push eax
push 0x41bff8
lea eax, [ebp - 0xc]
push eax
push ebx
push str.NNTP_Port
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x408f11
push dword [0x41a860]
push 0x41bff8
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
jmp 0x408f11
mov byte [0x41b5b8], bl
mov byte [0x41bff8], bl
lea eax, [ebp - 4]
push eax
push 0x41b190
lea eax, [ebp - 0xc]
push eax
push ebx
push str.POP3_server
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
test eax, eax
jne 0x408fff
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], edi
mov edi, 0x41c100
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
push str.POP3_Port
push dword [ebp - 8]
call esi
test eax, eax
je 0x408f62
push dword [0x41a864]
push edi
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.POP3_Login
push dword [ebp - 8]
mov edi, 0x203
mov dword [ebp - 4], edi
call esi
cmp dword [ebp - 4], ebx
je 0x408fa2
cmp eax, ebx
jne 0x408fa2
lea eax, [ebp - 0x214]
push 0x41c610
push eax
call fcn.0040f324
pop ecx
pop ecx
jmp 0x408fb2
push 0x41bde0
push 0x41c610
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.POP3_Pwd
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
cmp dword [ebp - 4], ebx
je 0x408fed
cmp eax, ebx
jne 0x408fed
lea eax, [ebp - 0x214]
push 0x421280
push eax
call fcn.0040f324
pop ecx
pop ecx
jmp 0x40900b
push 0x421790
push 0x421280
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40900b
mov byte [0x41b190], bl
mov byte [0x41c100], bl
cmp dword [ebp - 8], ebx
je 0x409019
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x41ab48], bl
push 0xc
pop eax
je 0x409042
cmp byte [0x41b3a0], bl
je 0x40902e
xor eax, eax
cmp byte [0x41b190], bl
je 0x409038
xor eax, eax
cmp byte [0x41b5b8], bl
je 0x409042
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret