Function at 0x433335
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x32a0
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x5c
xor ebx, ebx
mov dword [ebp - 0x390], 0x6976614e
lea eax, [ebp - 0x388]
mov dword [ebp - 0x38c], 0x746163
push ebx
push eax
call fcn.00626f50
mov esi, str.NavicatMARIADB
lea edi, [ebp - 0x32c]
push 0x55
lea eax, [ebp - 0x31d]
push ebx
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00626f50
mov esi, str.NavicatMONGODB
lea edi, [ebp - 0x2c8]
push 0x55
lea eax, [ebp - 0x2b9]
push ebx
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00626f50
mov esi, str.NavicatMSSQL
lea edi, [ebp - 0x264]
push 0x57
lea eax, [ebp - 0x257]
push ebx
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.00626f50
mov esi, str.NavicatOra
lea edi, [ebp - 0x200]
push 0x59
lea eax, [ebp - 0x1f5]
push ebx
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00626f50
mov esi, str.NavicatPG
lea edi, [ebp - 0x19c]
push 0x5a
lea eax, [ebp - 0x192]
push ebx
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00626f50
mov esi, str.NavicatSQLite
lea edi, [ebp - 0x138]
add esp, 0x48
lea eax, [ebp - 0x12a]
movsd dword es:[edi], dword [esi]
push 0x56
push ebx
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00626f50
mov esi, str.NavicatREDIS
lea edi, [ebp - 0xd4]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xc7]
push 0x57
push ebx
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.00626f50
mov esi, str.RecoverNavicatPasswords
mov dword [ebp - 0x3290], 0x270
push esi
push str._s___Entered
mov dword [ebp - 0x328c], 0x271
mov dword [ebp - 0x3288], 0x272
mov dword [ebp - 0x3284], 0x273
mov dword [ebp - 0x3280], 0x274
mov dword [ebp - 0x327c], 0x275
mov dword [ebp - 0x3278], 0x276
mov dword [ebp - 0x3274], 0x277
mov dword [ebp - 0x3298], 0x3e8
call fcn.00449974
lea eax, [ebp - 0x3294]
mov dword [ebp - 0xc], 0x35434433
push eax
lea eax, [ebp - 0x70]
mov dword [ebp - 8], 0x39334143
push eax
push 8
pop ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 0x3294], 0x64
push ebx
push eax
mov dword [ebp - 0x32a0], ebx
call fcn.004492a8
add esp, 0x30
test eax, eax
jne 0x433512
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str._s___Failed_to_compute_the_SHA1_hash__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x43366e
push dword [ebp - 0x3294]
push esi
push str._s___SHA1_Hash_of_secret_key_is__d
call fcn.00449974
push dword [ebp - 0x3294]
lea eax, [ebp - 0x70]
push eax
call fcn.004498ca
push 0x70f560
push dword [ebp - 0x3294]
lea eax, [ebp - 0x70]
push eax
call fcn.0044851c
add esp, 0x20
lea edi, [ebp - 0x3290]
lea esi, [ebp - 0x390]
push esi
push str.SoftwarePremiumSoft_sServers
lea eax, [ebp - 0x778]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x778]
push eax
push str.RecoverNavicatPasswords
push str._n_n_s___Opening_Navicat_software_registry_key__s
call fcn.00449974
add esp, 0x1c
lea eax, [ebp - 0x329c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x778]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x433656
lea eax, [ebp - 0x778]
push eax
push str.RecoverNavicatPasswords
push str._s_:_Found_software_location__s_...now_enumerating_all_stored_profiles
call fcn.00449974
add esp, 0xc
lea eax, [ebp - 0x3298]
xor ecx, ecx
mov ebx, ecx
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0xb60]
push eax
push ecx
jmp 0x43362a
lea eax, [ebp - 0xb60]
push eax
lea eax, [ebp - 0x778]
push eax
push 0x66c218
lea eax, [ebp - 0x3270]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x3270]
push eax
push dword [edi]
call fcn.00417176
add esp, 0x1c
inc ebx
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x3298]
push eax
lea eax, [ebp - 0xb60]
push eax
push ebx
push dword [ebp - 0x329c]
mov dword [ebp - 0x3298], 0x3e8
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x4335df
push dword [ebp - 0x329c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x32a0]
add esi, 0x64
add edi, 4
sub ebx, 1
mov dword [ebp - 0x32a0], ebx
jne 0x433555
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret