Function at 0x40281f
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov eax, 0x41c735
call fcn.0041c000
push ecx
mov eax, 0x1448
call fcn.0041c090
mov eax, dword [0x426e88]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1440], ecx
xor ebx, ebx
mov esi, 0x95
xor eax, eax
mov word [ebp - 0x26c], bx
mov ecx, esi
lea edi, [ebp - 0x26a]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10], esp
stosw word es:[edi], ax
lea eax, [ebp - 0x1448]
push eax
push 0x20019
push ebx
push str.SOFTWARENetwork_AssociatesePolicy_Orchestrator
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1448], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4028d4
lea eax, [ebp - 0x1444]
push eax
lea eax, [ebp - 0x26c]
push eax
push ebx
push ebx
push str.ServerINI
push dword [ebp - 0x1448]
mov dword [ebp - 0x1444], 0x258
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x1448]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
mov byte [ebp - 0x1439], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x4028e6
push str.ConnectToDatabase_failed:_Cannot_find_ServerINI_n
call sub.msvcrt.dll_wprintf
pop ecx
xor al, al
jmp 0x402c83
xor eax, eax
xor edx, edx
mov word [ebp - 0xb7c], dx
mov ecx, esi
lea edi, [ebp - 0xb7a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0xdd4], dx
mov ecx, esi
lea edi, [ebp - 0xdd2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x924], dx
mov ecx, esi
lea edi, [ebp - 0x922]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x6cc], dx
mov ecx, esi
lea edi, [ebp - 0x6ca]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x102c], dx
mov ecx, esi
lea edi, [ebp - 0x102a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x26c]
push eax
mov ebx, 0x12c
push ebx
lea eax, [ebp - 0x102c]
push eax
push 0x41d9bc
push str.Version
mov esi, str.Server
push esi
call edi
push 4
lea eax, [ebp - 0x102c]
push str.3.6.
push eax
call sub.msvcrt.dll_wcsncmp
mov ecx, dword [ebp - 0x1440]
add esp, 0xc
neg eax
sbb al, al
inc al
mov byte [ecx], al
lea eax, [ebp - 0x26c]
push eax
push 0
push str.UseNTAccount
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
lea eax, [ebp - 0x26c]
push eax
push ebx
lea eax, [ebp - 0xb7c]
push eax
push 0x41d9bc
push str.DataSource
push esi
setne byte [ebp - 0x143a]
call edi
lea eax, [ebp - 0x26c]
push eax
push ebx
lea eax, [ebp - 0xdd4]
push eax
push 0x41d9bc
push str.Database
push esi
call edi
lea eax, [ebp - 0x26c]
cmp byte [ebp - 0x143a], 0
push eax
push ebx
lea eax, [ebp - 0x924]
push eax
push 0x41d9bc
je 0x402a37
push str.NTUserName
push esi
call edi
lea eax, [ebp - 0x26c]
push eax
push ebx
lea eax, [ebp - 0x6cc]
push eax
push 0x41d9bc
push str.NTPassword
jmp 0x402a58
push str.UserName
push esi
call edi
lea eax, [ebp - 0x26c]
push eax
push ebx
lea eax, [ebp - 0x6cc]
push eax
push 0x41d9bc
push str.Password
push esi
call edi
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x474], bx
mov ecx, 0x81
lea edi, [ebp - 0x472]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x144c]
push eax
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x6cc]
mov esi, 0x208
push eax
mov dword [ebp - 0x144c], esi
call sub.msvcrt.dll_wcslen
pop ecx
push eax
lea eax, [ebp - 0x6cc]
push eax
push 0x3a
call fcn.0040a520
add esp, 0x14
push ebx
lea ecx, [ebp - 0x1438]
call fcn.00401710
cmp byte [ebp - 0x143a], bl
mov dword [ebp - 4], ebx
je 0x402b07
mov ecx, dword [ebp - 0x1440]
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x924]
push eax
call fcn.004012cb
mov byte [ebp - 0x1439], al
lea eax, [ebp - 0xdd4]
push eax
lea eax, [ebp - 0xb7c]
push eax
lea eax, [ebp - 0x1438]
push str.ProviderSQLOLEDB.1_Integrated_SecuritySSPI_Persist_Security_InfoFalse_Data_Source_s_Initial_Catalog_s
push eax
call fcn.00401770
add esp, 0x10
jmp 0x402b37
lea eax, [ebp - 0xdd4]
push eax
lea eax, [ebp - 0xb7c]
push eax
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x924]
push eax
lea eax, [ebp - 0x1438]
push str.ProviderSQLOLEDB.1_Persist_Security_InfoFalse_User_ID__s__Password__s__Data_Source_s_Initial_Catalog_s
push eax
call fcn.00401770
add esp, 0x18
mov byte [ebp - 4], 1
lea eax, [ebp - 0x474]
cmp esi, ebx
je 0x402b4c
mov byte [eax], 0
inc eax
dec esi
jmp 0x402b41
mov esi, dword [ebp - 0x1440]
add esi, 0xc
cmp dword [esi], ebx
je 0x402b6e
mov ecx, esi
call fcn.004013f4
mov ecx, eax
call fcn.0040114e
mov ecx, esi
call fcn.004013d5
push 0x17
push ebx
push 0x41da64
mov ecx, esi
call fcn.00401c42
cmp eax, ebx
jge 0x402b87
push eax
call fcn.0041be50
push ecx
mov eax, esp
mov dword [ebp - 0x1444], esp
push eax
lea ecx, [ebp - 0x1438]
call fcn.00402806
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.004013f4
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040211b
mov ecx, esi
call fcn.004013f4
push 0x1e
mov ecx, eax
call fcn.0040112a
mov ecx, esi
call fcn.004013f4
push 0x258
mov ecx, eax
call fcn.00401106
push 0x41d9bc
lea ecx, [ebp - 0x1440]
call fcn.004015f1
push 0xffffffffffffffff
push ecx
lea eax, [ebp - 0x1440]
mov ecx, esp
mov dword [ebp - 0x1444], esp
push eax
call fcn.0040185d
push ecx
lea eax, [ebp - 0x1440]
mov ecx, esp
mov dword [ebp - 0x1458], esp
push eax
call fcn.0040185d
push ecx
lea eax, [ebp - 0x1440]
mov ecx, esp
mov dword [ebp - 0x1454], esp
push eax
call fcn.0040185d
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.004013f4
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004021da
mov ecx, esi
call fcn.004013f4
mov ecx, eax
call fcn.0040116f
mov ecx, dword [ebp - 0x1440]
cmp eax, 1
sete byte [ebp - 0x1439]
cmp ecx, ebx
je 0x402c63
call fcn.0040187f
lea eax, [ebp - 0x1434]
cmp dword [ebp - 0x1438], eax
je 0x402c7d
push dword [ebp - 0x1438]
call sub.msvcrt.dll_free
pop ecx
mov al, byte [ebp - 0x1439]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0041c4f6
pop edi
pop esi
pop ebx
leave
ret