Function at 0x4356c2
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xea84
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, str.RecoverOutlookPasswordsFromLocation
push edi
push esi
push dword [ebp + 0xc]
push ebx
push str._s_:_Entered__Outlook16_d__location_s
call fcn.00449974
add esp, 0x10
lea eax, [ebp - 0xea7c]
xor edi, edi
push eax
push 0x20019
push edi
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43572b
push eax
push ebx
push str._s_:_Failed_to_open_Windows_NT_Windows_Messaging_Subsystem_Profiles_key__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x435a33
push esi
push ebx
push str._s_:_Enumerating_key_within__s
call fcn.00449974
add esp, 0xc
mov dword [ebp - 0xea84], edi
lea eax, [ebp - 0xea78]
mov ebx, edi
push edi
push edi
push edi
push edi
push eax
lea eax, [ebp - 0x4e24]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x4359f7
lea eax, [ebp - 0x4e24]
push eax
push esi
push 0x66c218
lea eax, [ebp - 0x7534]
push 0x2710
push eax
call fcn.00445d6d
add esp, 0x14
lea eax, [ebp - 0xea74]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x7534]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4357c4
push eax
lea eax, [ebp - 0x7534]
push eax
push str.RecoverOutlookPasswordsFromLocation
push str._s_:_Failed_to_open__s_key__Error0x_.8x
call fcn.00449974
add esp, 0x10
jmp 0x4359db
lea eax, [ebp - 0x7534]
push eax
push str.RecoverOutlookPasswordsFromLocation
push str._s_:_t_tEnumerating_key_within__s
call fcn.00449974
add esp, 0xc
lea eax, [ebp - 0xea70]
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0xea80], ecx
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0xc354]
push eax
push ecx
jmp 0x43599c
lea eax, [ebp - 0xc354]
push eax
lea eax, [ebp - 0x4e24]
push eax
push esi
push 0x66d710
lea eax, [ebp - 0x2714]
push 0x2710
push eax
call fcn.00445d6d
add esp, 0x18
lea eax, [ebp - 0xea6c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x2714]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43586a
push eax
lea eax, [ebp - 0x2714]
push eax
push str.RecoverOutlookPasswordsFromLocation
push str._s_:_Failed_to_open__s_key__Error0x_.8x
call fcn.00449974
add esp, 0x10
jmp 0x435980
lea eax, [ebp - 0x2714]
mov ebx, str.RecoverOutlookPasswordsFromLocation
push eax
push ebx
push str._s_:_t_t_tChecking_for_account_with_key__s
call fcn.00449974
add esp, 0xc
lea eax, [ebp - 0x2714]
cmp dword [ebp + 0xc], 0
push eax
je 0x435898
call fcn.00405912
jmp 0x43589d
call fcn.00406298
pop ecx
lea eax, [ebp - 0x2714]
push eax
push ebx
push str._s_:_t_t_tEnumerating_key_within__s
call fcn.00449974
add esp, 0xc
lea eax, [ebp - 0xea68]
xor ecx, ecx
mov ebx, ecx
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0xea64]
push eax
push ecx
jmp 0x435941
lea eax, [ebp - 0xea64]
push eax
lea eax, [ebp - 0xc354]
push eax
lea eax, [ebp - 0x4e24]
push eax
push esi
push str._s_s_s_s
lea eax, [ebp - 0x9c44]
push 0x2710
push eax
call fcn.00445d6d
lea eax, [ebp - 0x9c44]
push eax
push str.RecoverOutlookPasswordsFromLocation
push str._s_:_t_t_tEnumerating_values_within__s
call fcn.00449974
add esp, 0x28
lea eax, [ebp - 0x9c44]
cmp dword [ebp + 0xc], 0
push eax
je 0x435925
call fcn.00405912
jmp 0x43592a
call fcn.00406298
pop ecx
inc ebx
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0xea68]
push eax
lea eax, [ebp - 0xea64]
push eax
push ebx
push dword [ebp - 0xea6c]
mov dword [ebp - 0xea68], 0x2710
call edi
test eax, eax
je 0x4358cc
push eax
push str.RecoverOutlookPasswordsFromLocation
push str._s_:_RegEnumKeyEx_returned_with_status__0x_.8x
call fcn.00449974
add esp, 0xc
push dword [ebp - 0xea6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0xea80]
inc ebx
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0xea70]
mov dword [ebp - 0xea80], ebx
push eax
lea eax, [ebp - 0xc354]
push eax
push ebx
push dword [ebp - 0xea74]
mov dword [ebp - 0xea70], 0x2710
call edi
test eax, eax
je 0x4357ff
push eax
push str.RecoverOutlookPasswordsFromLocation
push str._s_:_RegEnumKeyEx_returned_with_status__0x_.8x
call fcn.00449974
add esp, 0xc
push dword [ebp - 0xea74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0xea84]
inc ebx
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0xea78]
mov dword [ebp - 0xea84], ebx
push eax
lea eax, [ebp - 0x4e24]
push eax
push ebx
push dword [ebp - 0xea7c]
mov dword [ebp - 0xea78], 0x2710
call edi
test eax, eax
je 0x435760
push eax
push str.RecoverOutlookPasswordsFromLocation
push str._s_:_RegEnumKeyEx_returned_with_status__0x_.8x
call fcn.00449974
add esp, 0xc
push dword [ebp - 0xea7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret