Function at 0x4ddd00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa54
mov eax, dword [0x5552b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0xa40]
push eax
push 0x101
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftMicrosoft_SQL_ServerInstance_NamesSQL
mov esi, ecx
push reloc.WS2_32.dll_bind
mov dword [ebp - 0xa44], esi
mov dword [ebp - 0xa40], ebx
mov dword [ebp - 0xa30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4ddd5e
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e4746
mov esp, ebp
pop ebp
ret
push edi
mov dword [ebp - 0xa3c], ebx
mov dword [ebp - 0xa4c], ebx
mov dword [ebp - 0xa34], ebx
mov edi, 0x208
push edi
lea ecx, [ebp - 0x414]
push ebx
push ecx
call fcn.004e8ba0
push edi
lea edx, [ebp - 0xa2c]
push ebx
push edx
mov dword [ebp - 0xa50], edi
call fcn.004e8ba0
add esp, 0x18
lea eax, [ebp - 0xa50]
push eax
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0xa4c]
push edx
mov edx, dword [ebp - 0xa34]
push ebx
lea eax, [ebp - 0xa54]
push eax
mov eax, dword [ebp - 0xa40]
lea ecx, [ebp - 0xa2c]
push ecx
push edx
push eax
mov dword [ebp - 0xa54], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, ebx
jne 0x4de296
push edi
lea ecx, [ebp - 0x20c]
push ebx
push ecx
call fcn.004e8ba0
push 7
lea edx, [ebp - 0x414]
push str.MSSQL.1
push edx
call fcn.004e5007
add esp, 0x18
test eax, eax
jne 0x4dde2c
lea esp, [esp]
movzx ecx, word [eax + str.Microsoft_SQL_Server_2005_x64]
mov word [ebp + eax - 0x20c], cx
add eax, 2
cmp cx, bx
jne 0x4dde10
jmp 0x4ddfa7
push 8
lea eax, [ebp - 0x414]
push str.MSSQL10.
push eax
call fcn.004e5007
add esp, 0xc
test eax, eax
jne 0x4dde6c
jmp 0x4dde50
movzx ecx, word [eax + str.Microsoft_SQL_Server_2008_x64]
mov word [ebp + eax - 0x20c], cx
add eax, 2
cmp cx, bx
jne 0x4dde50
jmp 0x4ddfa7
push 0xb
lea ecx, [ebp - 0x414]
push str.MSSQL10_50.
push ecx
call fcn.004e5007
add esp, 0xc
test eax, eax
jne 0x4ddeac
jmp 0x4dde90
movzx ecx, word [eax + str.Microsoft_SQL_Server_2008R2_x64]
mov word [ebp + eax - 0x20c], cx
add eax, 2
cmp cx, bx
jne 0x4dde90
jmp 0x4ddfa7
push 8
lea edx, [ebp - 0x414]
push str.MSSQL11.
push edx
call fcn.004e5007
add esp, 0xc
test eax, eax
jne 0x4ddeec
jmp 0x4dded0
movzx ecx, word [eax + str.Microsoft_SQL_Server_2012_x64]
mov word [ebp + eax - 0x20c], cx
add eax, 2
cmp cx, bx
jne 0x4dded0
jmp 0x4ddfa7
push 8
lea eax, [ebp - 0x414]
push str.MSSQL12.
push eax
call fcn.004e5007
add esp, 0xc
test eax, eax
jne 0x4ddf2c
jmp 0x4ddf10
movzx ecx, word [eax + str.Microsoft_SQL_Server_2014_x64]
mov word [ebp + eax - 0x20c], cx
add eax, 2
cmp cx, bx
jne 0x4ddf10
jmp 0x4ddfa7
push 8
lea ecx, [ebp - 0x414]
push str.MSSQL13.
push ecx
call fcn.004e5007
add esp, 0xc
test eax, eax
jne 0x4ddf69
jmp 0x4ddf50
movzx ecx, word [eax + str.Microsoft_SQL_Server_2016_x64]
mov word [ebp + eax - 0x20c], cx
add eax, 2
cmp cx, bx
jne 0x4ddf50
jmp 0x4ddfa7
push 8
lea edx, [ebp - 0x414]
push str.MSSQL14.
push edx
call fcn.004e5007
add esp, 0xc
test eax, eax
jne 0x4de28b
jmp 0x4ddf90
movzx ecx, word [eax + str.Microsoft_SQL_Server_2017_x64]
mov word [ebp + eax - 0x20c], cx
add eax, 2
cmp cx, bx
jne 0x4ddf90
push edi
lea eax, [ebp - 0x824]
push ebx
push eax
mov dword [ebp - 0xa30], ebx
call fcn.004e8ba0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x824]
push str.SOFTWAREMicrosoftMicrosoft_SQL_Server_sSetup
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0xa30]
push eax
push 0x101
push ebx
lea ecx, [ebp - 0x824]
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4de0a2
push edi
lea edx, [ebp - 0x61c]
push ebx
push edx
call fcn.004e8ba0
add esp, 0xc
lea eax, [ebp - 0xa48]
push eax
mov eax, dword [ebp - 0xa30]
lea ecx, [ebp - 0x61c]
push ecx
lea edx, [ebp - 0xa38]
push edx
push ebx
push str.Edition
push eax
mov dword [ebp - 0xa48], edi
mov dword [ebp - 0xa38], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0xa30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x61c]
mov dword [ebp - 0xa30], ebx
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4de062
lea edi, [ebp - 0x20c]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4de080
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x4de080
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0xa44]
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
jmp 0x4de0b0
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x4de0b0
mov edx, dword [0x51ccdc]
push 0x208
lea eax, [ebp - 0x824]
push ebx
push eax
mov dword [edi], edx
call fcn.004e8ba0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x824]
push str.SOFTWAREMicrosoftMicrosoft_SQL_Server_sMSSQLServerCurrentVersion
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0xa30]
push eax
push 1
push ebx
lea ecx, [ebp - 0x824]
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4de1c2
push 0x208
lea edx, [ebp - 0x61c]
push ebx
push edx
call fcn.004e8ba0
add esp, 0xc
lea eax, [ebp - 0xa48]
push eax
mov eax, dword [ebp - 0xa30]
lea ecx, [ebp - 0x61c]
push ecx
lea edx, [ebp - 0xa38]
push edx
push ebx
push str.CurrentVersion
push eax
mov dword [ebp - 0xa48], 0x208
mov dword [ebp - 0xa38], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0xa30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x61c]
mov dword [ebp - 0xa30], ebx
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4de182
lea edi, [ebp - 0x20c]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4de1a0
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x4de1a0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0xa44]
lea eax, [ebp - 0x20c]
add eax, 0xfffffffe
jmp 0x4de1d0
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x4de1d0
mov edx, dword [0x55093c]
mov cx, word [0x550940]
mov dword [eax], edx
mov word [eax + 4], cx
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4de1f4
sub eax, edx
sar eax, 1
lea eax, [ebp - 0x20c]
jne 0x4de222
mov edx, esi
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4de211
jmp 0x4de256
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4de224
sub eax, edx
lea edi, [esi - 2]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x4de234
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0xa44]
mov eax, esi
lea edx, [eax + 2]
jmp 0x4de260
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4de260
sub eax, edx
mov ecx, 1
add dword [ebp - 0xa3c], ecx
sar eax, 1
add dword [ebp - 0xa34], ecx
mov edx, ecx
mov word [esi + eax*2], dx
jmp 0x4ddd71
inc dword [ebp - 0xa34]
jmp 0x4ddd76
mov eax, dword [ebp - 0xa40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0xa3c], ebx
pop edi
setg al
pop esi
xor ecx, ebp
pop ebx
call fcn.004e4746
mov esp, ebp
pop ebp
ret