Function at 0x48c280
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x5c7004]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x54], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], edx
push edi
mov dword [ebp - 0x3c], 0
xor ebx, ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call fcn.0048bb60
test eax, eax
jne 0x48c2df
lea eax, [ebx + 0x7e]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00534c91
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x20]
mov edx, 0x59d1dc
push ecx
push 0x59d1ec
mov ecx, eax
call fcn.004c1620
mov edi, eax
test edi, edi
js 0x48c534
mov edi, edi
test esi, esi
je 0x48c309
mov eax, dword [esi + 4]
jmp 0x48c30b
xor eax, eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea edx, [ebp - 0x1c]
mov ecx, eax
mov eax, dword [ebp - 0x20]
push edx
push 0
push 0
mov esi, dword [eax]
push 0x80
push 0
push 0
mov esi, dword [esi + 0xc]
push 0
push ecx
mov dword [ebp - 0x50], ecx
mov ecx, esi
push eax
call dword [0x55890c]
call esi
mov edi, eax
or esi, 0xffffffff
test edi, edi
js 0x48c4f7
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x48c357
mov eax, dword [eax + 4]
jmp 0x48c359
xor eax, eax
push eax
push str.SELECT_clsid_FROM___Win32Provider_WHERE_Name___s
call sym.ProcessHacker.exe_PhFormatString
add esp, 8
mov ebx, eax
push 0x5946a4
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x4c], edi
test ebx, ebx
je 0x48c383
mov eax, dword [ebx + 4]
jmp 0x48c385
xor eax, eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, eax
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push edx
push 0
push 0x30
mov esi, dword [eax]
push ecx
push edi
mov dword [ebp - 0x48], ecx
mov esi, dword [esi + 0x50]
mov ecx, esi
push eax
call dword [0x55890c]
call esi
mov edi, eax
test edi, edi
js 0x48c4d6
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x14]
push ecx
mov esi, dword [eax]
push 1
push 0xffffffffffffffff
push eax
mov esi, dword [esi + 0x10]
mov ecx, esi
call dword [0x55890c]
call esi
mov edi, eax
test edi, edi
js 0x48c4d6
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
push 0
push 0
push ecx
mov esi, dword [eax]
push 0
push str.CLSID
push eax
mov esi, dword [esi + 0x10]
mov ecx, esi
call dword [0x55890c]
call esi
test eax, eax
js 0x48c432
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x48c428
push eax
call sym.ProcessHacker.exe_PhCreateString
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword ds:[ebp - 0x14]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x55890c]
call esi
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x48c4d6
push 0x5837f0
push 0x562d24
push dword [eax + 4]
push str.CLSID_
push 4
call sym.ProcessHacker.exe_PhConcatStrings
add esp, 0x14
mov dword [ebp - 0x44], eax
push 0
push eax
push 0xfffffffffffffff9
push 0x20019
lea eax, [ebp - 0x10]
push eax
call sym.ProcessHacker.exe_PhOpenKey
mov edi, eax
or edi, 0x10000000
jl 0x48c4ce
push 0
push dword [ebp - 0x10]
call sym.ProcessHacker.exe_PhQueryRegistryString
mov esi, eax
mov dword [ebp - 0x3c], esi
test esi, esi
je 0x48c4c5
push esi
call sym.ProcessHacker.exe_PhExpandEnvironmentStrings
test eax, eax
je 0x48c4c5
mov dword [ebp - 0x3c], eax
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x48c4c5
nop
call fcn.004c1f60
push dword [ebp - 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
push dword [ebp - 0x44]
call sym.ProcessHacker.exe_PhDereferenceObject
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x48c4e6
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x48c4f4
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
or esi, 0xffffffff
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x48c506
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x48c51f
lea ecx, [eax - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x48c51f
call fcn.004c1f60
nop
test ebx, ebx
je 0x48c534
lea ecx, [ebx - 8]
lock xadd dword [ecx + 4], esi
dec esi
jne 0x48c534
call fcn.004c1f60
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x48c54b
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x55890c]
call esi
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x48c568
mov eax, dword ds:[ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x55890c]
call esi
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x48c57f
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x55890c]
call esi
nop
test edi, edi
js 0x48c58c
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x3c]
mov dword [ecx], eax
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00534c91
mov esp, ebp
pop ebp
ret 4