Function at 0x4121e8
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
push 0x3ff
mov dword [ebp - 0x410], eax
lea eax, [ebp - 0x403]
push ebx
push eax
mov byte [ebp - 0x404], bl
call fcn.00626f50
push dword [ebp - 0x410]
push edi
push str.GetWindowsMailData
push str._s_entered_reg_s__file_s
call fcn.00449974
add esp, 0x1c
mov dword [0x716c58], ebx
lea eax, [ebp - 0x40c]
mov byte [0x716870], bl
mov byte [esi], bl
push eax
push 0x20019
push ebx
push edi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x412286
push eax
push edi
push str.GetWindowsMailData
push str._s_:_Failed_to_open_Windows_Live_Mail_Registry_key__s__Error0x_.8x
call fcn.00449974
add esp, 0x10
xor eax, eax
jmp 0x412513
lea eax, [ebp - 0x408]
mov dword [ebp - 0x408], 0x3e8
push eax
push 0x716870
lea eax, [ebp - 0x418]
push eax
push ebx
push str.Salt
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4122cf
push eax
push edi
push str.GetWindowsMailData
push str._s_:_Failed_to_find_entropy_data_in_the_Registry__s__Error0x_.8x
call fcn.00449974
add esp, 0x10
jmp 0x412301
mov eax, dword [ebp - 0x408]
mov edi, str.GetWindowsMailData
push eax
push edi
push str._n_n_s___Found_Salt_data_of_length___d
mov dword [0x716c58], eax
call fcn.00449974
push dword [ebp - 0x410]
call fcn.00631510
add esp, 0x10
cmp eax, 1
jae 0x412314
xor ebx, ebx
inc ebx
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x412513
lea eax, [ebp - 0x408]
mov dword [ebp - 0x408], 0x400
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x418]
push eax
push ebx
push str.Store_Root
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
lea ecx, [ebp - 0x404]
mov edx, str._s_:_Failed_to_find_Profile_Path_in_the_Registry__Error0x_.8x
cmovne ecx, eax
push ecx
mov ecx, str._n_n_s_____Found_Profile_Path_in_registry___s
cmovne ecx, edx
push edi
push ecx
call fcn.00449974
add esp, 0xc
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x404]
push eax
call fcn.00631510
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
pop ecx
cmp eax, 1
jbe 0x412412
lea eax, [ebp - 0x414]
push eax
push 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4123ea
push dword [ebp + 0x14]
lea eax, [ebp - 0x404]
push esi
push eax
push dword [ebp - 0x414]
call dword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserA]
test eax, eax
jne 0x4123dc
call edi
push eax
push str.GetWindowsMailData
push str._n_n_s_________ExpandEnvironmentStringsForUser_Failed____s
call fcn.00449974
add esp, 0xc
mov byte [esi], bl
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4123ff
call edi
push eax
push str.GetWindowsMailData
push str._n_n_s_________OpenProcessToken_failed__Errro0x_.8x
call fcn.00449974
add esp, 0xc
push esi
push str.GetWindowsMailData
push str._n_n_s_____After_expansion__Profile_Path_is___s
call fcn.00449974
add esp, 0xc
push esi
call fcn.00631510
pop ecx
cmp eax, 1
jb 0x41242d
push esi
call fcn.0044975e
pop ecx
test eax, eax
jne 0x412510
push str.GetWindowsMailData
push str._n_n_s_____File_not_found_in_registry....directly_getting_file_location....
call fcn.00449974
pop ecx
pop ecx
lea eax, [ebp - 0x404]
push eax
push ebx
push ebx
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x41246e
call edi
push eax
push str.GetWindowsMailData
push str._s_Failed_to_find_local_appdata_folder__Error0x_.8x
call fcn.00449974
add esp, 0xc
jmp 0x41227f
push dword [ebp - 0x410]
lea eax, [ebp - 0x404]
push eax
push 0x66c218
push 0x3e8
push esi
call fcn.00445d6d
push esi
call fcn.0044975e
add esp, 0x18
test eax, eax
jne 0x4124fd
lea eax, [ebp - 0x404]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x4124bd
call edi
push eax
push str.GetWindowsMailData
push str._s_Failed_to_find_appdata_folder__Error0x_.8x
jmp 0x412461
push dword [ebp - 0x410]
lea eax, [ebp - 0x404]
push eax
push 0x66c218
push 0x3e8
push esi
call fcn.00445d6d
push esi
call fcn.0044975e
add esp, 0x18
test eax, eax
jne 0x4124fd
push str.GetWindowsMailData
push str._s_Failed_to_find_Windows_Mail_folder_in_both_appdata__localappdata_folder_...returning..
call fcn.00449974
pop ecx
pop ecx
jmp 0x41227f
push esi
push str.GetWindowsMailData
push str._n_n_s____Found_Windows_Mail_data_location___s
call fcn.00449974
add esp, 0xc
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret