Function at 0x1002bbd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1938
call fcn.01007dd0
mov eax, dword [0x100ae94]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x1934], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x1508
lea eax, [ebp - 0x1924]
push 0
push eax
call fcn.01007dbe
add esp, 0xc
cmp dword [ebp + 8], 3
jle 0x1003292
mov ebx, dword [0x1001130]
push 0x103
push dword [esi + 4]
lea eax, [ebp - 0x1104]
push eax
call ebx
push dword [esi + 8]
mov edi, dword [0x100112c]
and word [ebp - 0xefe], 0
call edi
push dword [esi + 0xc]
mov dword [ebp - 0x192c], eax
call edi
add esp, 0x14
cmp eax, 1
mov dword [ebp - 0x1928], eax
je 0x1002c58
cmp dword [ebp - 0x192c], 4
jne 0x1002c79
and dword [ebp - 0x192c], 0
jmp 0x1002c79
cmp dword [ebp + 8], 4
jle 0x1002c72
push dword [esi + 0x10]
call edi
neg eax
sbb eax, eax
neg eax
pop ecx
mov dword [ebp - 0x830], eax
jmp 0x1002c79
and dword [ebp - 0x830], 0
mov edi, dword [ebp + 8]
cmp edi, 4
jle 0x1002c9d
push 0x103
push dword [esi + 0x10]
lea eax, [ebp - 0xefc]
push eax
call ebx
add esp, 0xc
and word [ebp - 0xcf6], 0
cmp dword [ebp - 0x1928], 4
jne 0x1002d10
cmp edi, 5
jl 0x1003292
cmp dword [ebp - 0x192c], 1
je 0x1002cc4
cmp edi, 6
jg 0x1002cc4
and dword [ebp - 0x192c], 0
cmp dword [ebp - 0x192c], 0
je 0x1002d10
push 0x103
push dword [esi + 0x14]
lea eax, [ebp - 0xa88]
push eax
call ebx
and word [ebp - 0x882], 0
add esp, 0xc
cmp edi, 6
jle 0x1002d10
cmp dword [ebp - 0x192c], 1
je 0x1002d10
push 0x27
push dword [esi + 0x18]
lea eax, [ebp - 0x880]
push eax
call ebx
add esp, 0xc
and word [ebp - 0x832], 0
mov eax, dword [ebp - 0x192c]
dec eax
cmp eax, 3
ja 0x1003292
mov eax, dword [ebp - 0x1928]
lea ecx, [eax - 1]
cmp ecx, 3
ja 0x1003292
cmp eax, 1
je 0x1002d54
lea eax, [ebp - 0xefc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1002d40
sub eax, edx
sar eax, 1
je 0x1003292
call fcn.01008160
test eax, eax
jne 0x1002d67
mov eax, 0x20000101
jmp 0x1003297
push str.MSSQLServerCurrentVersion
lea eax, [ebp - 0x1104]
push eax
lea eax, [ebp - 0x41c]
push 0x104
push eax
call fcn.01002b83
mov ebx, eax
add esp, 0x10
test ebx, ebx
jl 0x1003269
lea eax, [ebp - 0x1934]
push eax
push 0x20019
xor edi, edi
push edi
lea eax, [ebp - 0x41c]
push eax
mov esi, 0x80000002
push esi
call dword [fcn.01001018]
test eax, eax
jne 0x1002df8
lea eax, [ebp - 0x1930]
push eax
push 0x100b514
lea eax, [ebp - 0x1938]
push eax
push edi
push str.Language
push dword [ebp - 0x1934]
mov dword [ebp - 0x1930], 4
call dword [fcn.01001014]
push dword [ebp - 0x1934]
call dword [fcn.01001010]
mov dword [ebp - 0x1934], edi
push 0x84
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x1104]
push eax
call fcn.01004993
add esp, 0xc
cmp eax, edi
je 0x1002e2e
push eax
push 0x1001450
call fcn.010044ce
pop ecx
pop ecx
mov eax, 0x20000004
jmp 0x1003297
mov ebx, dword [0x1001128]
lea eax, [ebp - 0x10c]
push eax
push str.LocalSystem
call ebx
mov edi, eax
neg edi
sbb edi, edi
pop ecx
inc edi
cmp dword [ebp - 0x192c], 3
pop ecx
jne 0x1002e61
cmp dword [ebp - 0x1928], 1
je 0x1002f37
test edi, edi
jne 0x1002f37
cmp dword [ebp - 0x192c], 1
jne 0x1002ecb
cmp dword [ebp - 0x1928], 1
jne 0x1002ecb
lea eax, [ebp - 0x1924]
push 1
push eax
call fcn.010029b1
test eax, eax
pop ecx
pop ecx
je 0x1002ec4
mov esi, 0x20000006
cmp eax, esi
jne 0x1002ead
push 0
push 0x10013e0
call fcn.010044ce
pop ecx
pop ecx
mov eax, esi
jmp 0x1003297
push eax
push 0x1001378
call fcn.010044ce
pop ecx
pop ecx
mov eax, 0x20000005
jmp 0x1003297
xor eax, eax
jmp 0x1003297
lea eax, [ebp - 0x1924]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.010040fa
test eax, eax
pop ecx
pop ecx
jne 0x1002f1f
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x1002f37
lea eax, [ebp - 0x1924]
push 2
push eax
call fcn.010029b1
test eax, eax
pop ecx
pop ecx
je 0x1002f37
mov esi, 0x20000006
cmp eax, esi
je 0x1002e98
push eax
push 0x10012e0
jmp 0x1002eb3
push 0
push 0x1001258
call fcn.010044ce
pop ecx
pop ecx
mov eax, 0x20000003
jmp 0x1003297
push 0
call dword [0x1001184]
mov ebx, eax
test ebx, ebx
jge 0x1002f5c
push ebx
push 0x1001228
call fcn.010044ce
pop ecx
pop ecx
mov eax, 0x20000001
jmp 0x1003297
push 0x100120c
call fcn.01004bf4
test eax, eax
pop ecx
mov dword [ebp - 0x1930], eax
jne 0x1002f7b
mov ebx, 0x20000007
jmp 0x1003254
push 0x10011fc
push dword [ebp - 0x1930]
call dword [0x10010a0]
test eax, eax
mov dword [0x100b508], eax
jne 0x1002fa0
call dword [0x10010a8]
jmp 0x1003252
push 0x10011f0
push dword [ebp - 0x1930]
call dword [0x10010a0]
test eax, eax
mov dword [0x100b50c], eax
je 0x1002f95
cmp dword [ebp - 0x192c], 4
jne 0x1002fe4
cmp dword [ebp - 0x1928], 1
jne 0x1003254
lea eax, [ebp - 0x1924]
push eax
push 1
push esi
call fcn.010071ef
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 0x192c], 1
jne 0x10030c8
cmp dword [ebp - 0x1928], 1
jne 0x100301f
mov eax, edi
neg eax
sbb eax, eax
not eax
lea ecx, [ebp - 0x10c]
and eax, ecx
push eax
lea eax, [ebp - 0x1924]
push eax
push 1
push esi
call fcn.010073fe
add esp, 0x10
mov ebx, eax
cmp dword [ebp - 0x1928], 2
jne 0x100304d
mov eax, edi
neg eax
sbb eax, eax
not eax
lea ecx, [ebp - 0x10c]
and eax, ecx
push eax
lea eax, [ebp - 0x1924]
push eax
push 1
push esi
call fcn.01006ed1
add esp, 0x10
mov ebx, eax
cmp dword [ebp - 0x1928], 4
jne 0x10030a7
mov eax, edi
neg eax
sbb eax, eax
not eax
lea ecx, [ebp - 0x10c]
and eax, ecx
push eax
lea eax, [ebp - 0x1924]
push eax
push 1
push esi
call fcn.0100663e
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x1003254
and eax, 0xffff
cmp eax, 0x1392
jne 0x1003254
lea eax, [ebp - 0x1924]
push eax
push 1
push esi
call fcn.01006bb4
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 0x1928], 3
jne 0x1003254
lea eax, [ebp - 0x1924]
push eax
push 1
push esi
call fcn.01006463
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 0x192c], 2
jne 0x10031d9
cmp dword [ebp - 0x1928], 1
jne 0x1003123
lea eax, [ebp - 0x1924]
push eax
push 1
push esi
call fcn.01006fbf
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1003254
and eax, 0xffff
cmp eax, 0x2030
je 0x1003111
cmp eax, 0x202b
jne 0x1003254
lea eax, [ebp - 0x1924]
push 1
push eax
call fcn.010029b1
pop ecx
pop ecx
mov ebx, eax
cmp dword [ebp - 0x1928], 2
jne 0x100317d
lea eax, [ebp - 0x1924]
push eax
push 1
push esi
call fcn.01005f41
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1003254
and eax, 0xffff
cmp eax, 0x2030
jne 0x1003254
mov eax, edi
neg eax
sbb eax, eax
not eax
lea ecx, [ebp - 0x10c]
and eax, ecx
push eax
lea eax, [ebp - 0x1924]
push eax
push 1
push esi
call fcn.01006ed1
add esp, 0x10
mov ebx, eax
cmp dword [ebp - 0x1928], 4
jne 0x1003254
lea eax, [ebp - 0x1924]
push eax
push 1
push esi
call fcn.01006bb4
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1003254
and eax, 0xffff
cmp eax, 0x2030
jne 0x1003254
neg edi
sbb edi, edi
lea eax, [ebp - 0x10c]
not edi
and edi, eax
push edi
lea eax, [ebp - 0x1924]
push eax
push 1
push esi
call fcn.0100663e
add esp, 0x10
jmp 0x1003252
cmp dword [ebp - 0x192c], 3
jne 0x1003254
cmp dword [ebp - 0x1928], 1
jne 0x10031fd
lea eax, [ebp - 0x1924]
push 3
push eax
call fcn.010029b1
pop ecx
pop ecx
mov ebx, eax
cmp dword [ebp - 0x1928], 2
jne 0x100321a
lea eax, [ebp - 0x1924]
push eax
push 1
push esi
call fcn.0100614c
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 0x1928], 4
jne 0x1003237
lea eax, [ebp - 0x1924]
push eax
push 1
push esi
call fcn.0100688e
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 0x1928], 3
jne 0x1003254
lea eax, [ebp - 0x1924]
push eax
push 1
push esi
call fcn.0100653e
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 0x1930], 0
je 0x1003269
push dword [ebp - 0x1930]
call dword [0x10010a4]
call dword [0x1001180]
test ebx, ebx
je 0x1002ec4
test ebx, 0x20000000
je 0x1003283
mov eax, ebx
jmp 0x1003297
push ebx
push 0x10011cc
call fcn.010044ce
pop ecx
pop ecx
jmp 0x100327f
mov eax, 0x20000100
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01007a04
leave
ret