Function at 0x4410ee
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x15a8
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x5c
xor ebx, ebx
mov dword [ebp - 0xcc], 0x7365614d
lea eax, [ebp - 0xc4]
mov dword [ebp - 0xc8], 0x6f7274
push ebx
push eax
call fcn.00626f50
mov esi, str.Code_Factory
lea edi, [ebp - 0x68]
push 0x57
lea eax, [ebp - 0x5b]
push ebx
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.00626f50
mov eax, dword [str.MySQL]
mov dword [ebp - 0x57c], eax
mov ax, word [0x6835a4]
push 0x5e
mov word [ebp - 0x578], ax
lea eax, [ebp - 0x576]
push ebx
push eax
call fcn.00626f50
mov esi, str.My_SQL
lea edi, [ebp - 0x518]
push 0x5d
pop ebx
push ebx
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x511]
push 0
push eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00626f50
mov esi, str.MSSQLServer
lea edi, [ebp - 0x4b4]
push 0x58
lea eax, [ebp - 0x4a8]
push 0
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00626f50
mov esi, str.MS_SQL_Server
lea edi, [ebp - 0x450]
push 0x56
lea eax, [ebp - 0x442]
push 0
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00626f50
mov esi, str.Oracle
lea edi, [ebp - 0x3ec]
add esp, 0x48
lea eax, [ebp - 0x3e5]
movsd dword es:[edi], dword [esi]
push ebx
push 0
push eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00626f50
mov esi, str.PostgreSQL
lea edi, [ebp - 0x388]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x59
lea eax, [ebp - 0x37d]
push 0
push eax
call fcn.00626f50
push 0x60
lea eax, [ebp - 0x320]
mov dword [ebp - 0x324], 0x415341
push 0
push eax
call fcn.00626f50
mov esi, str.AnySQL
lea edi, [ebp - 0x2c0]
push ebx
lea eax, [ebp - 0x2b9]
push 0
movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00626f50
push 0x60
lea eax, [ebp - 0x258]
mov dword [ebp - 0x25c], 0x324244
push 0
push eax
call fcn.00626f50
mov esi, str.Firebird
lea edi, [ebp - 0x1f8]
push 0x5b
lea eax, [ebp - 0x1ef]
push 0
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.00626f50
mov eax, dword [str.MaxDB]
add esp, 0x48
mov dword [ebp - 0x194], eax
mov ax, word [0x6835f8]
mov word [ebp - 0x190], ax
lea eax, [ebp - 0x18e]
push 0x5e
push 0
push eax
call fcn.00626f50
mov esi, str.SQLite
lea edi, [ebp - 0x130]
push ebx
lea eax, [ebp - 0x129]
push 0
movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00626f50
mov eax, 0x25a
mov dword [ebp - 0x1584], 0x25c
mov dword [ebp - 0x1594], eax
add esp, 0x18
mov dword [ebp - 0x1590], eax
inc eax
mov dword [ebp - 0x158c], eax
mov dword [ebp - 0x1588], eax
mov eax, 0x264
mov dword [ebp - 0x1564], eax
mov dword [ebp - 0x1560], eax
inc eax
mov dword [ebp - 0x1580], 0x25d
mov dword [ebp - 0x157c], 0x25e
mov dword [ebp - 0x1578], 0x25f
mov dword [ebp - 0x1574], 0x260
mov dword [ebp - 0x1570], 0x261
mov dword [ebp - 0x156c], 0x262
mov dword [ebp - 0x1568], 0x263
mov dword [ebp - 0x155c], eax
mov dword [ebp - 0x1558], eax
mov dword [ebp - 0x1554], 0x266
mov dword [ebp - 0x1550], 0x267
mov dword [ebp - 0x154c], 0x268
push 6
pop ecx
xor eax, eax
mov dword [ebp - 0x1548], 0x269
lea edi, [ebp - 0x1534]
mov dword [ebp - 0x1544], 0x26a
mov dword [ebp - 0x1540], 0x26b
lea ebx, [ebp - 0xcc]
mov dword [ebp - 0x153c], 0x26c
mov dword [ebp - 0x1538], 0x26d
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x1594]
mov dword [ebp - 0x15a4], ebx
mov dword [ebp - 0x15a8], 2
push ebx
push str.SoftwareSQL_Maestro_Group_s
lea eax, [ebp - 0xd4c]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0xd4c]
push eax
push ebx
push str.RecoversqlMaestroPasswords
push str._n_n_n_n__s:_Now_looking_for_group_softwares__s___s
call fcn.00449974
add esp, 0x20
lea esi, [ebp - 0x57c]
push 0xc
pop ebx
mov dword [ebp - 0x15a0], ebx
push esi
lea eax, [ebp - 0xd4c]
push eax
push str._s_sProfiles
lea eax, [ebp - 0x964]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x964]
push eax
push esi
push str.RecoversqlMaestroPasswords
push str._n_n_s:_Opening_registry_location_for__s___s
call fcn.00449974
add esp, 0x24
lea eax, [ebp - 0x159c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x964]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x441526
xor ecx, ecx
lea eax, [ebp - 0x1598]
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0x151c]
mov ebx, ecx
push eax
push ecx
jmp 0x4414e7
lea eax, [ebp - 0x151c]
push eax
lea eax, [ebp - 0x964]
push eax
push 0x66c218
lea eax, [ebp - 0x1134]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x1134]
push eax
push str.RecoversqlMaestroPasswords
push str._n_n_s_:_Found_profile_location__s
call fcn.00449974
lea eax, [ebp - 0x1134]
push eax
push dword [edi]
call fcn.00441569
add esp, 0x28
inc ebx
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x1598]
push eax
lea eax, [ebp - 0x151c]
push eax
push ebx
push dword [ebp - 0x159c]
mov dword [ebp - 0x1598], 0x3e8
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x441486
push eax
push str.RecoversqlMaestroPasswords
push str._s_:_RegEnumKeyEx_terminated_with_status__0x_.8x
call fcn.00449974
add esp, 0xc
push dword [ebp - 0x159c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x15a0]
add edi, 4
add esi, 0x64
sub ebx, 1
mov dword [ebp - 0x15a0], ebx
jne 0x44140d
mov ebx, dword [ebp - 0x15a4]
add ebx, 0x64
sub dword [ebp - 0x15a8], 1
mov dword [ebp - 0x15a4], ebx
jne 0x4413cd
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.005fe955
leave
ret