Function at 0x1006e170
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x538
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x534], eax
mov eax, dword [esp + 0x53c]
push ebx
push ebp
push esi
push edi
mov esi, edx
xor ebx, ebx
push 0x103
lea edx, [esp + 0x35]
push ebx
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], esi
mov byte [esp + 0x3c], bl
call fcn.10116880
push 0x103
lea eax, [esp + 0x249]
push ebx
push eax
mov byte [esp + 0x250], bl
call fcn.10116880
push 0x103
lea ecx, [esp + 0x359]
push ebx
push ecx
mov byte [esp + 0x360], bl
call fcn.10116880
push 0x103
lea edx, [esp + 0x469]
push ebx
push edx
mov byte [esp + 0x470], bl
call fcn.10116880
push 0x103
lea eax, [esp + 0x169]
push ebx
push eax
mov byte [esp + 0x170], bl
call fcn.10116880
xor eax, eax
add esp, 0x3c
mov byte [esp + 0x28], bl
mov dword [esp + 0x29], eax
mov word [esp + 0x2d], ax
mov byte [esp + 0x2f], al
cmp esi, ebx
je 0x1006e237
mov byte [esi], bl
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push ebx
push str.Identities
push closesocket
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, eax
push esi
call ebp
cmp esi, ebx
jne 0x1006e440
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x340]
push eax
push ebx
push ebx
push str.Default_User_ID
push ecx
mov byte [esp + 0x354], bl
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1006e440
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x33c]
push eax
lea ecx, [esp + 0x444]
push str.Identities_sSoftwareMicrosoftInternet_Account_Manager
push ecx
call fcn.1010d6a8
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0xf003f
push ebx
lea eax, [esp + 0x44c]
push eax
push closesocket
call edi
mov esi, eax
push esi
call ebp
cmp esi, ebx
jne 0x1006e440
lea ecx, [esp + 0x440]
push ecx
lea edx, [esp + 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x34]
push ecx
push ebx
push ebx
push str.Default_Mail_Account
push edx
mov byte [esp + 0x48], bl
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x30], bl
je 0x1006e440
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x138]
push edx
lea eax, [esp + 0x240]
push str._sAccounts_s
push eax
call fcn.1010d6a8
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push ebx
lea edx, [esp + 0x244]
push edx
push closesocket
call edi
mov esi, eax
push esi
call ebp
cmp esi, ebx
jne 0x1006e440
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x1006e3b5
mov ecx, dword [esp + 0x550]
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [esp + 0x18]
push ebx
push ebx
push str.SMTP_Server
push eax
mov dword [esp + 0x2c], ecx
call esi
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x1006e3dc
mov ecx, dword [esp + 0x554]
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [esp + 0x18]
push ebx
push ebx
push str.SMTP_Email_Address
push eax
mov dword [esp + 0x2c], ecx
call esi
mov edi, dword [esp + 0x20]
cmp edi, ebx
je 0x1006e42b
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x2c]
push eax
push ebx
push str.SMTP_Port
push ecx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x2c], 8
call esi
cmp byte [esp + 0x28], bl
jne 0x1006e41b
mov byte [esp + 0x28], 0x19
mov edx, dword [esp + 0x28]
push 0xa
push edi
push edx
call fcn.101348c9
add esp, 0xc
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1006e500
push str.SoftwareMicrosoftInternet_Account_Manager
lea ecx, [esp + 0x138]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x10]
push edx
push 0xf003f
push ebx
lea eax, [esp + 0x140]
push eax
push closesocket
call edi
mov esi, eax
push esi
call ebp
cmp esi, ebx
jne 0x1006e4fe
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x34]
push edx
push ebx
push ebx
push str.Default_Mail_Account
push eax
mov byte [esp + 0x48], bl
mov dword [esp + 0x2c], 0x104
call esi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x30], bl
je 0x1006e4fe
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x138]
push eax
lea ecx, [esp + 0x240]
push str._sAccounts_s
push ecx
call fcn.1010d6a8
add esp, 0x10
lea edx, [esp + 0x10]
push edx
push 0xf003f
push ebx
lea eax, [esp + 0x244]
push eax
push closesocket
call edi
mov edi, eax
push edi
call ebp
cmp edi, ebx
je 0x1006e38e
xor eax, eax
mov ecx, dword [esp + 0x544]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1010d699
add esp, 0x538
ret