Function at 0x100410400
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x100422010]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp dword [0x10044c054], 0
je 0x100410535
cmp qword [rsp + 0xa8], 0
je 0x10041044f
mov rax, qword [rsp + 0xa8]
movzx eax, word [rax]
test eax, eax
jne 0x100410469
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
call fcn.1004102d0
jmp 0x1004106e2
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
call fcn.10040f500
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x10041049a
mov ecx, 8
call fcn.10040ee00
jmp 0x1004106e2
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.10040fab0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1004104eb
mov rcx, qword [rsp + 0x48]
call fcn.10040ed00
test eax, eax
je 0x1004104cb
mov dword [rsp + 0x34], 2
jmp 0x1004104d3
mov dword [rsp + 0x34], 0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x48]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1004104f3
mov dword [rsp + 0x34], 8
cmp dword [rsp + 0x34], 0
je 0x100410512
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100410522
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov ecx, dword [rsp + 0x34]
call fcn.10040ee00
jmp 0x1004106e2
cmp dword [0x10044c268], 0
je 0x1004106b6
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0xa0]
call fcn.100410f60
cmp dword [rsp + 0x68], 0
je 0x10041056a
mov ecx, 2
call fcn.10040ee00
jmp 0x1004106e2
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1004105cb
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x60]
call fcn.1004110c0
test eax, eax
je 0x1004105cb
mov rax, qword [rsp + 0xb0]
mov qword [rax], 0
mov dword [rsp + 0x30], 0
cmp dword [rsp + 0x30], 0
je 0x100410681
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
call fcn.10040f500
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x100410681
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.10040fe20
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x50]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [rsp + 0x38], 0xffffffff
je 0x100410681
movsxd rax, dword [rsp + 0x38]
imul rax, rax, 0x50
lea rcx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftMicrosoft_SQL_ServerMSSQLMSSQLServerEULA
lea rdx, [0x10044c690]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + rax + 0x20]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jbe 0x100410681
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
mov qword [rax], rcx
mov dword [rsp + 0x30], 0
cmp dword [rsp + 0x30], 0
jne 0x1004106a9
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
call fcn.100410e10
mov dword [rsp + 0x30], eax
mov ecx, dword [rsp + 0x30]
call fcn.10040ee00
jmp 0x1004106e2
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1004119e0
add rsp, 0x98
ret