Function at 0x48061df0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c0
mov eax, dword [0x4806700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x54
mov dword [ebp - 0x21c], 3
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 1
mov dword [ebp - 8], 0
jmp 0x48061e46
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 0x228], 0
jne 0x4806210b
cmp dword [ebp - 8], 2
jae 0x4806210b
mov dword [ebp - 0x230], 0
mov ecx, dword [ebp - 0x224]
mov dword [ebp - 0x234], ecx
jmp 0x48061e84
mov edx, dword [ebp - 0x230]
add edx, 1
mov dword [ebp - 0x230], edx
cmp dword [ebp - 0x228], 0
jne 0x480620cc
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0x21c]
jae 0x480620cc
push 0x480611a0
push 0x208
lea ecx, [ebp - 0x218]
push ecx
call fcn.48061b20
mov edx, dword [ebp - 0x230]
mov eax, dword [edx*4 + section..data]
push eax
push 0x208
lea ecx, [ebp - 0x218]
push ecx
call fcn.48062130
cmp dword [ebp + 0x10], 0
jne 0x48061eed
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x48062111
cmp dword [ebp + 0xc], 0
je 0x48061efd
mov edx, dword [ebp + 0xc]
movzx eax, word [edx]
test eax, eax
jne 0x48061f04
mov dword [ebp + 0xc], 0x48061118
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x224]
push edx
push 0
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x480620c7
mov dword [ebp - 0x238], 0x50
lea edx, [ebp - 0x238]
push edx
lea eax, [ebp - 0x290]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x220], 0
jne 0x480620c7
mov dword [ebp - 0x294], 0x104
cmp dword [ebp - 0x22c], 0
jne 0x48061fab
mov dword [ebp - 0x22c], 1
lea ecx, [ebp - 0x290]
push ecx
push 0x4e
mov edx, dword [ebp + 0x10]
push edx
call fcn.48061b20
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x4a0]
push ecx
lea edx, [ebp - 0x290]
push edx
call sym.instapi.dll_GetSQLBinPathByInstID
cmp eax, 1
jne 0x480620c7
mov dword [ebp - 0x6bc], 0x105
mov dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x6bc]
push eax
lea ecx, [ebp - 0x6b8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 0
jne 0x48062015
xor eax, eax
jmp 0x48062111
lea edx, [ebp - 0x6b8]
push edx
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 4
mov dword [ebp - 0x4a8], eax
lea eax, [ebp - 0x4a0]
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 4
mov dword [ebp - 0x294], eax
mov ecx, dword [ebp - 0x294]
cmp ecx, dword [ebp - 0x4a8]
ja 0x480620c7
mov edx, dword [ebp - 0x294]
mov dword [ebp - 0x6c0], edx
mov eax, dword [ebp - 0x294]
movzx ecx, word [ebp + eax*2 - 0x4a2]
cmp ecx, 0x5c
jne 0x4806207d
mov edx, dword [ebp - 0x6c0]
sub edx, 1
mov dword [ebp - 0x6c0], edx
mov eax, dword [ebp - 0x6c0]
push eax
lea ecx, [ebp - 0x4a0]
push ecx
mov edx, dword [ebp - 0x6c0]
push edx
lea eax, [ebp - 0x6b8]
push eax
push 1
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x480620c7
mov dword [ebp - 0x228], 1
lea ecx, [ebp - 0x290]
push ecx
push 0x4e
mov edx, dword [ebp + 0x10]
push edx
call fcn.48061b20
jmp 0x48061e75
cmp dword [ebp - 0x228], 0
jne 0x48062106
lea eax, [ebp - 0x234]
push eax
mov ecx, dword [ebp - 0x224]
push ecx
call fcn.48064fe0
mov edx, dword [ebp - 0x224]
cmp edx, dword [ebp - 0x234]
jne 0x480620fa
jmp 0x4806210b
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x224], eax
jmp 0x48061e3d
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.48065788
mov esp, ebp
pop ebp
ret 0xc