Function at 0x410fe0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x532380
mov eax, dword fs:[0]
push eax
sub esp, 0x368
mov eax, dword [0x5bc684]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x35c], ebx
mov dword [ebp - 4], ebx
mov byte [esi], bl
mov byte [edi], bl
push 0x104
push ebx
lea eax, [ebp - 0x14c]
push eax
call fcn.004ff6f0
add esp, 0xc
lea ecx, [ebp - 0x374]
push ecx
lea edx, [ebp - 0x360]
push edx
push ebx
push 1
push ebx
push ebx
push ebx
push str.SoftwareQualcommEudoraCommandLine
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41123f
mov dword [ebp - 0x36c], 1
mov dword [ebp - 0x364], 0x208
mov byte [ebp - 0x354], bl
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x354]
push ecx
lea edx, [ebp - 0x36c]
push edx
push ebx
push str.Current
mov eax, dword [ebp - 0x360]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x411232
lea eax, [ebp - 0x354]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4110c0
sub eax, edx
je 0x411232
mov ecx, dword [str.eudora.ini]
mov dword [ebp - 0x2c], ecx
mov edx, dword [0x54fd3c]
mov dword [ebp - 0x28], edx
mov ax, word [0x54fd40]
mov word [ebp - 0x24], ax
mov cl, byte [0x54fd42]
mov byte [ebp - 0x22], cl
lea edx, [ebp - 0x354]
push edx
call fcn.00530199
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x354]
push ecx
call fcn.004fee10
add esp, 0xc
mov dword [ebp - 0x358], eax
cmp eax, ebx
je 0x41116f
lea ecx, [ecx]
lea edx, [ebp - 0x354]
cmp eax, edx
je 0x411138
cmp byte [eax], 0x20
je 0x411138
dec eax
mov dword [ebp - 0x358], eax
jmp 0x411120
mov byte [eax], 0x20
inc eax
mov dword [ebp - 0x358], eax
lea edx, [ebp - 0x14c]
mov dword [ebp - 0x368], edx
mov edi, edi
mov cl, byte [eax]
cmp cl, bl
je 0x41116d
cmp cl, 0x20
je 0x41116d
mov byte [edx], cl
inc edx
mov dword [ebp - 0x368], edx
inc eax
mov dword [ebp - 0x358], eax
jmp 0x411150
mov byte [edx], bl
lea eax, [ebp - 0x14c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x411178
sub eax, edx
je 0x411232
mov eax, dword [str.Settings]
mov dword [ebp - 0x20], eax
mov ecx, dword [0x54fd30]
mov dword [ebp - 0x1c], ecx
mov dl, byte [0x54fd34]
mov byte [ebp - 0x18], dl
mov eax, dword [str.SMTPServer]
mov dword [ebp - 0x38], eax
mov ecx, dword [0x54fd24]
mov dword [ebp - 0x34], ecx
mov dx, word [0x54fd28]
mov word [ebp - 0x30], dx
mov al, byte [0x54fd2a]
mov byte [ebp - 0x2e], al
mov ecx, dword [str.ReturnAddress]
mov dword [ebp - 0x48], ecx
mov edx, dword [0x54fd14]
mov dword [ebp - 0x44], edx
mov eax, dword [0x54fd18]
mov dword [ebp - 0x40], eax
mov cx, word [0x54fd1c]
mov word [ebp - 0x3c], cx
lea edx, [ebp - 0x14c]
push edx
push 0x104
push esi
push 0x54f15a
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x20]
push ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call esi
lea edx, [ebp - 0x14c]
push edx
push 0x104
push edi
push 0x54f15a
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x20]
push ecx
call esi
mov dword [ebp - 0x35c], 1
mov edx, dword [ebp - 0x360]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x35c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fe1f5
mov esp, ebp
pop ebp
ret