Decompilation isn't even needed. They know the credential being sent so an if(strings | grep -c "foo") != 0 SendEmail() is all that is required.