Function at 0x402b45
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov eax, 0x41ea3e
call fcn.0041e140
push ecx
mov eax, 0x144c
call fcn.0041e1c0
mov eax, dword [0x429e98]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov esi, ecx
xor edx, edx
xor eax, eax
mov word [ebp - 0x474], dx
mov ecx, 0x95
lea edi, [ebp - 0x472]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, 0x258
xor eax, eax
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x143c], dl
mov ecx, ebx
lea edi, [ebp - 0x143a]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1448]
push eax
push 0x20019
push edx
push str.SOFTWARENetwork_AssociatesePolicy_Orchestrator
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 0x143d], 0
mov dword [ebp - 0x1448], edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402d00
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x1444]
push eax
lea eax, [ebp - 0x474]
push eax
push 0
push 0
push str.DBPropsFile
push dword [ebp - 0x1448]
mov dword [ebp - 0x1444], ebx
call edi
neg eax
sbb al, al
inc al
mov byte [ebp - 0x143d], al
je 0x402c32
push dword [ebp - 0x1448]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x143c]
push eax
lea eax, [ebp - 0x474]
push eax
mov ecx, esi
mov dword [esi], 3
call fcn.004012cb
jmp 0x402d00
lea eax, [ebp - 0x1444]
push eax
lea eax, [ebp - 0x474]
push eax
push 0
push 0
push str.ServerINI
push dword [ebp - 0x1448]
mov dword [ebp - 0x1444], ebx
call edi
push dword [ebp - 0x1448]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
mov byte [ebp - 0x143d], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x402c87
push str.ConnectToDatabase_failed:_Cannot_find_ServerINI_n
call sub.msvcrt.dll_wprintf
pop ecx
xor al, al
jmp 0x402f21
and word [ebp - 0x6cc], 0
xor eax, eax
mov ecx, 0x95
lea edi, [ebp - 0x6ca]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x474]
push eax
push 0x12c
lea eax, [ebp - 0x6cc]
push eax
push 0x420688
push str.Version
push str.Server
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 4
lea eax, [ebp - 0x6cc]
push str.3.6.
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
neg eax
sbb eax, eax
inc eax
inc eax
mov dword [esi], eax
lea eax, [ebp - 0x143c]
push eax
lea eax, [ebp - 0x474]
push eax
mov ecx, esi
call fcn.004014c4
mov ebx, 0x258
and word [ebp - 0x21c], 0
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x21a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x1450]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0xd32]
mov edi, 0x208
push eax
mov dword [ebp - 0x1450], edi
call sub.msvcrt.dll_wcslen
pop ecx
push eax
lea eax, [ebp - 0xd32]
push eax
push 0x3a
call fcn.0040aba0
add esp, 0x14
push 0
lea ecx, [ebp - 0xad8]
call fcn.004019d5
and dword [ebp - 4], 0
cmp byte [ebp - 0x143c], 0
je 0x402daa
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0xf8a]
push eax
mov ecx, esi
call fcn.0040158c
mov byte [ebp - 0x143d], al
lea eax, [ebp - 0x11e2]
push eax
lea eax, [ebp - 0x143a]
push eax
lea eax, [ebp - 0xad8]
push str.ProviderSQLOLEDB.1_Integrated_SecuritySSPI_Persist_Security_InfoFalse_Data_Source_s_Initial_Catalog_s
push eax
call fcn.00401a35
add esp, 0x10
jmp 0x402dda
lea eax, [ebp - 0x11e2]
push eax
lea eax, [ebp - 0x143a]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0xf8a]
push eax
lea eax, [ebp - 0xad8]
push str.ProviderSQLOLEDB.1_Persist_Security_InfoFalse_User_ID__s__Password__s__Data_Source_s_Initial_Catalog_s
push eax
call fcn.00401a35
add esp, 0x18
mov byte [ebp - 4], 1
lea eax, [ebp - 0x21c]
test edi, edi
je 0x402def
mov byte [eax], 0
inc eax
dec edi
jmp 0x402de4
add esi, 0x21c
cmp dword [esi], 0
je 0x402e0f
mov ecx, esi
call fcn.0040169a
mov ecx, eax
call fcn.0040114e
mov ecx, esi
call fcn.004016b0
push 0x17
push 0
push 0x420c50
mov ecx, esi
call fcn.00401f2e
test eax, eax
jge 0x402e29
push eax
call fcn.0041c4b0
push ecx
mov eax, esp
mov dword [ebp - 0x144c], esp
push eax
lea ecx, [ebp - 0xad8]
call fcn.00402b2c
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0040169a
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040243b
mov ecx, esi
call fcn.0040169a
push 0x1e
mov ecx, eax
call fcn.0040112a
mov ecx, esi
call fcn.0040169a
push ebx
mov ecx, eax
call fcn.00401106
push 0x420688
lea ecx, [ebp - 0x1444]
call fcn.004018b6
push 0xffffffffffffffff
push ecx
lea eax, [ebp - 0x1444]
mov ecx, esp
mov dword [ebp - 0x144c], esp
push eax
call fcn.00401b22
push ecx
lea eax, [ebp - 0x1444]
mov ecx, esp
mov dword [ebp - 0x145c], esp
push eax
call fcn.00401b22
push ecx
lea eax, [ebp - 0x1444]
mov ecx, esp
mov dword [ebp - 0x1454], esp
push eax
call fcn.00401b22
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.0040169a
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004024fa
mov ecx, esi
call fcn.0040169a
mov ecx, eax
call fcn.0040116f
mov ecx, dword [ebp - 0x1444]
cmp eax, 1
sete byte [ebp - 0x143d]
test ecx, ecx
je 0x402f01
call fcn.00401b44
lea eax, [ebp - 0xad4]
cmp dword [ebp - 0xad8], eax
je 0x402f1b
push dword [ebp - 0xad8]
call fcn.0041e106
pop ecx
mov al, byte [ebp - 0x143d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0041e7f6
pop edi
pop esi
pop ebx
leave
ret