Function at 0x402fe0
Capabilities:
Access the windows event log
Query or enumerate registry value

Disassembly:
sub esp, 0x230
mov eax, dword [0x43e008]
xor eax, esp
mov dword [esp + 0x22c], eax
mov eax, dword [esp + 0x234]
push ebx
mov dword [esp + 0x1c], eax
mov ebx, ecx
mov eax, dword [esp + 0x23c]
push ebp
mov dword [esp + 0x10], eax
xor ebp, ebp
xor eax, eax
mov dword [esp + 0x24], 0x105
push esi
xor esi, esi
mov dword [esp + 0x1c], 0
cmp dword [0x43f2c4], eax
push edi
sete al
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.instapi160.dll_GetSQLRootRegPath]
test eax, eax
je 0x4035a2
mov ecx, dword [ebx + 0x7c]
xor eax, eax
mov edi, dword [ebx + 0x80]
mov word [esp + 0x238], ax
lea eax, [ebx + 0x7c]
mov dword [esp + 0x10], eax
mov dword [eax], esi
lea eax, [ebx + 0x80]
mov dword [esp + 0x1c], eax
mov dword [eax], esi
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ecx, ecx
je 0x40308c
push ecx
call eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x403093
push edi
call eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebx + 0x7c]
push eax
push 0x20019
push 0
lea eax, [esp + 0x3c]
push eax
push reloc.WS2_32.dll_bind
call edi
mov ecx, dword [0x43f2c4]
cmp eax, 2
jne 0x403105
test ecx, ecx
je 0x403109
mov ebp, 1
test ecx, ecx
je 0x4031a1
lea eax, [ebx + 0x80]
push eax
push 0x20119
push 0
lea eax, [esp + 0x3c]
push eax
push reloc.WS2_32.dll_bind
call edi
mov edi, eax
cmp edi, 2
jne 0x40316c
test ebp, ebp
jne 0x403170
push dword [ebx + 0x84]
lea edi, [eax - 1]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x4031b5
test eax, eax
je 0x4030c4
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.SQLBrowser
push 0
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40315c
lea eax, [esp + 0x30]
push eax
push 0
push 0x20a
push 0
push 0
push 0xc04e0001
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push edi
call ebx
jmp 0x4035f4
push 0
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push edi
call ebx
jmp 0x4035f4
test edi, edi
je 0x4031a1
test byte [0x43f278], 2
je 0x40319b
cmp dword [str._CSsrp::FGetInstalledInstancesINFO__WoW_InstalledInstances:__dWINERR_n], esi
je 0x40319b
mov eax, dword [str._CSsrp::FGetInstalledInstancesINFO__WoW_InstalledInstances:__dWINERR_n]
push edi
push eax
mov eax, dword [str.sql_ntdbms_browser_sqlbrowser_brwscore.cpp]
push 0x18a000
push eax
call fcn.00405110
add esp, 0x10
push edi
jmp 0x40310a
push dword [ebx + 0x84]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov edi, dword [esp + 0x14]
test ebp, ebp
jne 0x4031ce
push 1
push dword [ebx + 0x84]
push 4
push 0
push dword [ebx + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
jne 0x40321c
test edi, edi
jne 0x403266
push 1
push dword [ebx + 0x84]
push 4
push edi
push dword [ebx + 0x80]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
je 0x403266
test byte [0x43f278], 2
je 0x40321c
cmp dword [str._CSsrp::FGetInstalledInstancesINFO__WoW_reg_key_notify:__dWINERR_n], esi
je 0x40321c
push eax
mov eax, dword [str._CSsrp::FGetInstalledInstancesINFO__WoW_reg_key_notify:__dWINERR_n]
push eax
mov eax, dword [str.sql_ntdbms_browser_sqlbrowser_brwscore.cpp]
push 0x192c00
push eax
call fcn.00405110
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov dword [esp + 0x1c], eax
call esi
push str.SQLBrowser
push 0
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x4035e5
lea eax, [esp + 0x1c]
push eax
push 0
push 4
push 0
push 0
push 0xc04e0006
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
jmp 0x4035e7
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, dword [esp + 0x10]
test ebp, ebp
jne 0x4032d8
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], esi
push ecx
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0x4321c0
push dword [ebx]
call eax
test eax, eax
je 0x403299
cmp eax, 0xea
jne 0x4032b5
cmp dword [esp + 0x14], 7
je 0x4032b0
push 0x70c
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4035f6
add dword [esp + 0x20], 4
cmp eax, 2
jne 0x4032cb
cmp dword [0x43f2c4], esi
je 0x4035f6
lea ebp, [eax - 1]
jmp 0x4032d3
test eax, eax
jne 0x4035f6
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test edi, edi
jne 0x403322
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], esi
push ecx
push edi
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x28]
push edi
push 0x4321c0
push dword [ecx]
call eax
test eax, eax
je 0x403304
cmp eax, 0xea
jne 0x403310
cmp dword [esp + 0x14], 7
jne 0x4032a0
add dword [esp + 0x24], 4
cmp eax, 2
jne 0x40331a
lea edi, [eax - 1]
jmp 0x403322
test eax, eax
jne 0x4035f6
mov eax, dword [esp + 0x24]
mov edx, 2
mov esi, dword [esp + 0x20]
add eax, 4
mov ecx, dword [esp + 0x18]
add esi, eax
mov eax, esi
shr eax, 1
mov dword [ecx], eax
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041483d
mov ecx, eax
add esp, 4
xor eax, eax
mov dword [esp + 0x14], ecx
mov word [ecx], ax
test ebp, ebp
jne 0x403491
mov edx, dword [ebx]
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esp + 0x10], esi
cmp esi, 2
jae 0x403387
push 0xea
call ebp
mov ebx, 0xea
jmp 0x403428
lea eax, [esi - 2]
mov dword [esp + 0x10], eax
cmp eax, 2
jae 0x4033a4
push 0xea
call ebp
mov ebx, 0xea
jmp 0x403428
add eax, 0xfffffffe
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push ecx
lea eax, [esp + 0x20]
push eax
push 0
push 0x4321c0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
je 0x4033da
cmp ebx, 0xea
jne 0x403424
cmp dword [esp + 0x18], 7
je 0x4033ef
push 0x70c
call ebp
mov ebx, 0x70c
jmp 0x403428
mov eax, dword [esp + 0x10]
test ebx, ebx
jne 0x40341a
mov ecx, dword [esp + 0x14]
xor edx, edx
shr eax, 1
mov word [ecx + eax*2], dx
mov eax, dword [esp + 0x10]
add eax, 2
mov dword [esp + 0x10], eax
shr eax, 1
mov word [ecx + eax*2], dx
mov eax, dword [esp + 0x10]
jmp 0x40341d
add eax, 2
add eax, 2
mov dword [esp + 0x10], eax
test ebx, ebx
je 0x40348d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.SQLBrowser
push 0
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x403476
push 0x4321c0
push 0
push 0x26
push 0
push 0
push 0xc04e0001
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push edi
call ebp
push ebx
call ebp
mov esi, dword [esp + 0x14]
jmp 0x4035f6
push 0
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push edi
call ebp
push ebx
call ebp
mov esi, dword [esp + 0x14]
jmp 0x4035f6
mov ecx, dword [esp + 0x14]
test edi, edi
jne 0x403591
mov eax, dword [esp + 0x20]
cmp eax, 6
ja 0x4034a6
xor eax, eax
jmp 0x4034a9
add eax, 0xfffffffa
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
lea edi, [eax + ecx]
sub esi, eax
mov dword [esp + 0x10], esi
test edi, edi
je 0x4034f6
cmp esi, 2
jae 0x4034d2
push 0xea
call ebp
mov ebx, 0xea
jmp 0x403428
lea eax, [esi - 2]
mov dword [esp + 0x10], eax
cmp eax, 2
jae 0x4034ef
push 0xea
call ebp
mov ebx, 0xea
jmp 0x403428
add eax, 0xfffffffe
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0
push eax
push edi
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push 0
push 0x4321c0
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
je 0x40352a
cmp ebx, 0xea
jne 0x403589
cmp dword [esp + 0x18], 7
je 0x403542
push 0x70c
call ebp
mov ebx, 0x70c
jmp 0x403428
test edi, edi
je 0x403563
test ebx, ebx
jne 0x403563
mov eax, dword [esp + 0x10]
xor ecx, ecx
shr eax, 1
mov word [edi + eax*2], cx
mov eax, dword [esp + 0x10]
add eax, 2
mov dword [esp + 0x10], eax
jmp 0x403576
mov eax, dword [esp + 0x10]
add eax, 2
mov dword [esp + 0x10], eax
test edi, edi
je 0x403582
test ebx, ebx
jne 0x403582
shr eax, 1
xor ecx, ecx
mov word [edi + eax*2], cx
mov eax, dword [esp + 0x10]
add eax, 2
mov dword [esp + 0x10], eax
test ebx, ebx
jne 0x403428
mov eax, dword [esp + 0x28]
xor esi, esi
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
lea edi, [esi + 1]
jmp 0x4035f8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov dword [esp + 0x28], eax
call esi
push str.SQLBrowser
push 0
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x4035e5
lea eax, [esp + 0x28]
push eax
push 0
push 4
push 0
push 0
push 0xc04e0001
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
jmp 0x4035e7
push 0
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
xor edi, edi
push 2
push esi
call fcn.0041482a
mov ecx, dword [esp + 0x244]
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004145b4
add esp, 0x230
ret 8