Function at 0x401180
Capabilities:
Delete file
Get common file path
Get hostname
Query or enumerate registry value
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4166e8
push 0x407eec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, 0x1444
call fcn.00407db0
mov eax, dword [0x41b2c0]
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x658], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x657]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0xd08], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0xd07]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x250], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x24f]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x900], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x8ff]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x148], 0
mov ecx, 0x20
xor eax, eax
lea edi, [ebp - 0x147]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x7f8], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x7f7]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov byte [ebp - 0xa8], 0
mov ecx, 0x20
xor eax, eax
lea edi, [ebp - 0xa7]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x6f0], 0
mov ecx, 0x20
xor eax, eax
lea edi, [ebp - 0x6ef]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x664], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0x65c], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0x258], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0x904], 0
mov dword [ebp - 0x660], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xd10], 0
mov dword [ebp - 0xdac], 1
jmp 0x401312
mov eax, dword [ebp - 0xdac]
add eax, 1
mov dword [ebp - 0xdac], eax
mov ecx, dword [ebp - 0xdac]
cmp ecx, dword [ebp + 8]
jge 0x4014b6
mov edx, dword [ebp - 0xdac]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 0xd10], ecx
mov edx, dword [ebp - 0xd10]
movsx eax, byte [edx]
cmp eax, 0x2f
je 0x401354
mov ecx, dword [ebp - 0xd10]
movsx edx, byte [ecx]
cmp edx, 0x2d
je 0x401354
jmp 0x4014b6
mov eax, dword [ebp - 0xd10]
add eax, 1
mov dword [ebp - 0xd10], eax
mov ecx, dword [ebp - 0xd10]
movsx edx, byte [ecx]
mov dword [ebp - 0x1458], edx
mov eax, dword [ebp - 0x1458]
sub eax, 0x3f
mov dword [ebp - 0x1458], eax
cmp dword [ebp - 0x1458], 0x39
ja case.0x40139b.1
mov ecx, dword [ebp - 0x1458]
movzx edx, byte [ecx + 0x4025c1]
jmp dword [edx*4 + 0x402599]
push 0x104
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0xdac]
push ecx
mov edx, dword [ebp - 0xd10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401010
add esp, 0x18
jmp case.0x40139b.1
push 0x80
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0xdac]
push eax
mov ecx, dword [ebp - 0xd10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401010
add esp, 0x18
jmp case.0x40139b.1
push 0x80
lea ecx, [ebp - 0x6f0]
push ecx
lea edx, [ebp - 0xdac]
push edx
mov eax, dword [ebp - 0xd10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401010
add esp, 0x18
jmp case.0x40139b.1
push 0x80
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0xdac]
push ecx
mov edx, dword [ebp - 0xd10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401010
add esp, 0x18
jmp case.0x40139b.1
mov dword [ebp - 0xb4], 1
jmp case.0x40139b.1
mov dword [ebp - 0x664], 1
jmp case.0x40139b.1
mov dword [ebp - 0x1c], 1
jmp case.0x40139b.1
mov dword [ebp - 0x258], 1
jmp case.0x40139b.1
push str.usage:_sqldiag___U_login_id____I_instance_name____P_password____E____O_output_filename____X_exclude_error_logs_____M_perform_dbcc_stackdump_____C_retrieve_cluster_information___n
call fcn.00407cf5
add esp, 4
mov dword [ebp - 0x145c], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x145c]
jmp 0x402580
jmp 0x401303
movsx edx, byte [ebp - 0xa8]
test edx, edx
jne 0x4014cb
mov dword [ebp - 0xb4], 1
movsx eax, byte [ebp - 0x148]
test eax, eax
jne 0x40152b
push str.SOFTWAREMicrosoftMSSQLServer_
lea ecx, [ebp - 0x658]
push ecx
call fcn.00407700
add esp, 8
push str.MSSQLServerParameters
lea edx, [ebp - 0x658]
push edx
call fcn.00407710
add esp, 8
push str.SOFTWAREMicrosoftMSSQLServer_
lea eax, [ebp - 0xd08]
push eax
call fcn.00407700
add esp, 8
push str.Setup
lea ecx, [ebp - 0xd08]
push ecx
call fcn.00407710
add esp, 8
jmp 0x4015cf
push str.SOFTWAREMicrosoftMicrosoft_SQL_Server_
lea edx, [ebp - 0x658]
push edx
call fcn.00407700
add esp, 8
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x658]
push ecx
call fcn.00407710
add esp, 8
push 0x415384
lea edx, [ebp - 0x658]
push edx
call fcn.00407710
add esp, 8
push str.MSSQLServerParameters
lea eax, [ebp - 0x658]
push eax
call fcn.00407710
add esp, 8
push str.SOFTWAREMicrosoftMicrosoft_SQL_Server_
lea ecx, [ebp - 0xd08]
push ecx
call fcn.00407700
add esp, 8
lea edx, [ebp - 0x148]
push edx
lea eax, [ebp - 0xd08]
push eax
call fcn.00407710
add esp, 8
push 0x415388
lea ecx, [ebp - 0xd08]
push ecx
call fcn.00407710
add esp, 8
push str.Setup
lea edx, [ebp - 0xd08]
push edx
call fcn.00407710
add esp, 8
movsx eax, byte [ebp - 0x250]
test eax, eax
jne 0x4017ae
mov dword [ebp - 0xdb4], 0x104
mov dword [ebp - 0x10d8], 0x104
mov dword [ebp - 0x10e0], 0
mov dword [ebp - 0x10dc], 0
push 0x104
push 0
lea ecx, [ebp - 0xfc8]
push ecx
call fcn.00407c90
add esp, 0xc
lea edx, [ebp - 0xdb8]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x658]
push eax
push SQLCancel
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401659
push 0x41538c
lea ecx, [ebp - 0xfc8]
push ecx
call fcn.00407700
add esp, 8
jmp 0x401798
cmp dword [ebp - 0x10e0], 0
jne 0x40178b
mov dword [ebp - 0x10d8], 0x100
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x10d8]
push edx
lea eax, [ebp - 0xec0]
push eax
mov ecx, dword [ebp - 0x10dc]
push ecx
mov edx, dword [ebp - 0xdb8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x4016b7
push 0x41539c
lea eax, [ebp - 0xfc8]
push eax
call fcn.00407700
add esp, 8
jmp 0x40178b
mov dword [ebp - 0xdb4], 0x418
lea ecx, [ebp - 0xdb4]
push ecx
lea edx, [ebp - 0x10d0]
push edx
lea eax, [ebp - 0xdb0]
push eax
push 0
lea ecx, [ebp - 0xec0]
push ecx
mov edx, dword [ebp - 0xdb8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401709
push 0x4153ac
lea eax, [ebp - 0xfc8]
push eax
call fcn.00407700
add esp, 8
jmp 0x40178b
mov byte [ebp - 0xfcd], 0
push 2
lea ecx, [ebp - 0x10d0]
push ecx
push 0x4153bc
call fcn.00407c50
add esp, 0xc
test eax, eax
jne 0x401777
mov edx, dword [ebp - 0xdb4]
sub edx, 2
mov dword [ebp - 0x10d4], edx
mov eax, dword [ebp - 0x10d4]
sub eax, 9
push eax
lea ecx, [ebp - 0x10ce]
push ecx
lea edx, [ebp - 0xfc8]
push edx
call fcn.00407b20
add esp, 0xc
push str.SQLdiag.txt
lea eax, [ebp - 0xfc8]
push eax
call fcn.00407710
add esp, 8
mov dword [ebp - 0x10e0], 1
mov ecx, dword [ebp - 0x10dc]
add ecx, 1
mov dword [ebp - 0x10dc], ecx
jmp 0x401659
mov edx, dword [ebp - 0xdb8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xfc8]
push eax
lea ecx, [ebp - 0x250]
push ecx
call fcn.00407700
add esp, 8
push 0
lea edx, [ebp - 0x900]
push edx
push 0x105
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push 0
push 0x8100020
push 2
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x900]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xffffffff
jne 0x40183e
push str._Could_not_open_file_to_write__n
push 0x41b080
call fcn.00407930
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10e4], eax
cmp dword [ebp - 0x10e4], 0
je 0x40182d
mov edx, dword [ebp - 0x10e4]
push edx
call fcn.00405c70
add esp, 4
push 0
push 0
push 0
push 0xe0000110
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov dword [ebp - 0xd0c], 0x102
lea eax, [ebp - 0xd0c]
push eax
lea ecx, [ebp - 0x7f8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
movsx edx, byte [ebp - 0x148]
test edx, edx
je 0x401891
push 0x4153f4
lea eax, [ebp - 0x7f8]
push eax
call fcn.00407710
add esp, 8
lea ecx, [ebp - 0x148]
push ecx
lea edx, [ebp - 0x7f8]
push edx
call fcn.00407710
add esp, 8
mov dword [ebp - 4], 1
lea eax, [ebp - 0x7f8]
push eax
push str.Connecting_to_server__s_n
call fcn.00407cf5
add esp, 8
push str.SQL_Server_Diagnostic_Utility
push str.master
lea ecx, [ebp - 0x6f0]
push ecx
lea edx, [ebp - 0xa8]
push edx
mov eax, dword [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x7f8]
push ecx
lea edx, [ebp - 0x904]
push edx
lea eax, [ebp - 0xac]
push eax
call fcn.004058b0
add esp, 0x20
test eax, eax
jne 0x40197f
push str._Could_not_connect_to_server__n
push 0x41b080
call fcn.00407930
add esp, 8
push 0x400
push 0
push 0x41bc40
call fcn.00407c90
add esp, 0xc
push str.Unable_to_connect_to_server
push 0x41bc40
call fcn.00407700
add esp, 8
push 0
lea ecx, [ebp - 0x65c]
push ecx
push 0x41bc40
call fcn.00407800
add esp, 4
push eax
push 0x41bc40
mov edx, dword [ebp - 0xbc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x65c]
push eax
push 2
push 0x415480
mov ecx, dword [ebp - 0xbc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0
push 0
push 0xe0000003
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov dword [ebp - 0xb0], 1
lea edx, [ebp - 0x660]
push edx
mov eax, dword [ebp - 0x904]
push eax
call sub.ODBC32.dll_SQLAllocStmt
movsx ecx, ax
mov dword [ebp - 0x254], ecx
cmp dword [ebp - 0x254], 0
je 0x4019de
cmp dword [ebp - 0x254], 1
je 0x4019de
mov edx, dword [ebp - 0x254]
push edx
mov eax, dword [ebp - 0x660]
push eax
call fcn.00405cd0
add esp, 8
push 0
push 0
push 0
push 0xe0000105
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov dword [ebp - 4], 0
jmp 0x401a01
cmp dword [ebp - 0xb0], 0
je 0x401b00
mov dword [ebp - 4], 2
mov byte [ebp - 0x10e6], 0
mov byte [ebp - 0x10e5], 0
lea ecx, [ebp - 0x10e5]
push ecx
lea edx, [ebp - 0x10e6]
push edx
call fcn.00405c30
add esp, 8
test eax, eax
jl 0x401aa6
movzx eax, byte [ebp - 0x10e6]
cmp eax, 8
jge 0x401a89
push str.Getting_last_100_queries__n
call fcn.00407cf5
add esp, 4
lea ecx, [ebp - 0x900]
push ecx
mov edx, dword [ebp - 0x660]
push edx
mov eax, dword [ebp - 0x904]
push eax
mov ecx, dword [ebp - 0xac]
push ecx
lea edx, [ebp - 0xbc]
push edx
call fcn.00403b00
add esp, 0x14
mov dword [ebp - 0xb8], eax
jmp 0x401aa6
lea eax, [ebp - 0x900]
push eax
lea ecx, [ebp - 0x658]
push ecx
lea edx, [ebp - 0xbc]
push edx
call fcn.00403ec0
add esp, 0xc
cmp dword [ebp - 0x664], 0
je 0x401ae7
push str.Getting_dbcc_stackdump__n
call fcn.00407cf5
add esp, 4
push 0
push str.dbcc_stackdump
mov eax, dword [ebp - 0x660]
push eax
mov ecx, dword [ebp - 0x904]
push ecx
mov edx, dword [ebp - 0xac]
push edx
mov eax, dword [ebp - 0xbc]
push eax
call fcn.00403590
add esp, 0x18
mov dword [ebp - 4], 0
jmp 0x401b00
cmp dword [ebp - 0x1c], 0
jne 0x401b1c
lea ecx, [ebp - 0x658]
push ecx
mov edx, dword [ebp - 0xbc]
push edx
call fcn.00402aa0
add esp, 8
push 0
lea eax, [ebp - 0x65c]
push eax
push 2
push 0x4154cc
mov ecx, dword [ebp - 0xbc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x400
push 0
push 0x41bc40
call fcn.00407c90
add esp, 0xc
push str.Registry_Information
push 0x41bc40
call fcn.00407700
add esp, 8
push 0
lea edx, [ebp - 0x65c]
push edx
push 0x41bc40
call fcn.00407800
add esp, 4
push eax
push 0x41bc40
mov eax, dword [ebp - 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 0x65c]
push ecx
push 2
push 0x4154e8
mov edx, dword [ebp - 0xbc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x41bc40
call fcn.00407800
add esp, 4
push eax
push 0x2d
push 0x41bc40
call fcn.00407900
add esp, 0xc
push 0
lea eax, [ebp - 0x65c]
push eax
push 0x41bc40
call fcn.00407800
add esp, 4
push eax
push 0x41bc40
mov ecx, dword [ebp - 0xbc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0x65c]
push edx
push 2
push 0x4154ec
mov eax, dword [ebp - 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push str.Getting_registry_information_n
call fcn.00407cf5
add esp, 4
push 0
push str.SOFTWAREMicrosoftMSSQLServerClientConnectTo
mov ecx, dword [ebp - 0xbc]
push ecx
call fcn.00404870
add esp, 0xc
push 0
push str.SOFTWAREMicrosoftMSSQLServerClientDB_Lib
mov edx, dword [ebp - 0xbc]
push edx
call fcn.00404870
add esp, 0xc
push 0
lea eax, [ebp - 0xd08]
push eax
mov ecx, dword [ebp - 0xbc]
push ecx
call fcn.00404870
add esp, 0xc
push 0
lea edx, [ebp - 0x65c]
push edx
push 2
push 0x415570
mov eax, dword [ebp - 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x400
push 0
push 0x41bc40
call fcn.00407c90
add esp, 0xc
push str.Version_Information
push 0x41bc40
call fcn.00407700
add esp, 8
push 0
lea ecx, [ebp - 0x65c]
push ecx
push 0x41bc40
call fcn.00407800
add esp, 4
push eax
push 0x41bc40
mov edx, dword [ebp - 0xbc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x65c]
push eax
push 2
push 0x415588
mov ecx, dword [ebp - 0xbc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x41bc40
call fcn.00407800
add esp, 4
push eax
push 0x2d
push 0x41bc40
call fcn.00407900
add esp, 0xc
push 0
lea edx, [ebp - 0x65c]
push edx
push 0x41bc40
call fcn.00407800
add esp, 4
push eax
push 0x41bc40
mov eax, dword [ebp - 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 0x65c]
push ecx
push 2
push 0x41558c
mov edx, dword [ebp - 0xbc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push str.Getting_library_version_information_n
call fcn.00407cf5
add esp, 4
push str.ntwdblib.dll
mov eax, dword [ebp - 0xbc]
push eax
call fcn.004045a0
add esp, 8
push str.ssmsad60.dll
mov ecx, dword [ebp - 0xbc]
push ecx
call fcn.004045a0
add esp, 8
push str.ssmsde60.dll
mov edx, dword [ebp - 0xbc]
push edx
call fcn.004045a0
add esp, 8
push str.ssmsrp60.dll
mov eax, dword [ebp - 0xbc]
push eax
call fcn.004045a0
add esp, 8
push str.ssmsso60.dll
mov ecx, dword [ebp - 0xbc]
push ecx
call fcn.004045a0
add esp, 8
push str.ssmssp60.dll
mov edx, dword [ebp - 0xbc]
push edx
call fcn.004045a0
add esp, 8
push str.ssmsvi60.dll
mov eax, dword [ebp - 0xbc]
push eax
call fcn.004045a0
add esp, 8
push str.ssnmpn60.dll
mov ecx, dword [ebp - 0xbc]
push ecx
call fcn.004045a0
add esp, 8
push str.dbmsadsn.dll
mov edx, dword [ebp - 0xbc]
push edx
call fcn.004045a0
add esp, 8
push str.dbmsdecn.dll
mov eax, dword [ebp - 0xbc]
push eax
call fcn.004045a0
add esp, 8
push str.dbmsrpcn.dll
mov ecx, dword [ebp - 0xbc]
push ecx
call fcn.004045a0
add esp, 8
push str.dbmssocn.dll
mov edx, dword [ebp - 0xbc]
push edx
call fcn.004045a0
add esp, 8
push str.dbmsspxn.dll
mov eax, dword [ebp - 0xbc]
push eax
call fcn.004045a0
add esp, 8
push str.dbmsvinn.dll
mov ecx, dword [ebp - 0xbc]
push ecx
call fcn.004045a0
add esp, 8
push str.dbnmpntw.dll
mov edx, dword [ebp - 0xbc]
push edx
call fcn.004045a0
add esp, 8
push str.sqlsrv32.dll
mov eax, dword [ebp - 0xbc]
push eax
call fcn.004045a0
add esp, 8
cmp dword [ebp - 0xb0], 0
je 0x402296
mov dword [ebp - 4], 3
mov word [ebp - 0x1130], 0x40
mov word [ebp - 0x112c], 0
lea ecx, [ebp - 0x112c]
push ecx
mov dx, word [ebp - 0x1130]
push edx
lea eax, [ebp - 0x1128]
push eax
push 0x4d
mov ecx, dword [ebp - 0x904]
push ecx
call sub.ODBC32.dll_SQLGetInfo
push 0
lea edx, [ebp - 0x65c]
push edx
push 0x4156b8
call fcn.00407800
add esp, 4
push eax
push str.odbc32.dll
mov eax, dword [ebp - 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 0x65c]
push ecx
push 0x4156d0
call fcn.00407800
add esp, 4
push eax
push 0x4156d4
mov edx, dword [ebp - 0xbc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x65c]
push eax
push 2
push 0x4156d8
mov ecx, dword [ebp - 0xbc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0x65c]
push edx
movsx eax, word [ebp - 0x112c]
push eax
lea ecx, [ebp - 0x1128]
push ecx
mov edx, dword [ebp - 0xbc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x65c]
push eax
push 2
push 0x4156dc
mov ecx, dword [ebp - 0xbc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov word [ebp - 0x1130], 0x40
mov word [ebp - 0x112c], 0
lea edx, [ebp - 0x112c]
push edx
mov ax, word [ebp - 0x1130]
push eax
lea ecx, [ebp - 0x1128]
push ecx
push 7
mov edx, dword [ebp - 0x904]
push edx
call sub.ODBC32.dll_SQLGetInfo
push 0
lea eax, [ebp - 0x65c]
push eax
push 0x4156e0
call fcn.00407800
add esp, 4
push eax
push str.odbc32_driver
mov ecx, dword [ebp - 0xbc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0x65c]
push edx
push 0x415700
call fcn.00407800
add esp, 4
push eax
push 0x415704
mov eax, dword [ebp - 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 0x65c]
push ecx
push 2
push 0x415708
mov edx, dword [ebp - 0xbc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x65c]
push eax
movsx ecx, word [ebp - 0x112c]
push ecx
lea edx, [ebp - 0x1128]
push edx
mov eax, dword [ebp - 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 0x65c]
push ecx
push 2
push 0x41570c
mov edx, dword [ebp - 0xbc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push str.Getting_configuration_information__n
call fcn.00407cf5
add esp, 4
push str.___sp_configure
push str.declare__show_advance_int_if__select_value_from_master.dbo.syscurconfigs_where_config__518___1_select__show_advance__1_else_select__show_advance__0_if__show_advance__0_begin_exec_sp_configure_show_advanced_option_1_reconfigure_exec_sp_configure_texec_sp_configure_show_advanced_option_0_reconfigure_end_else_texec_sp_configure
mov eax, dword [ebp - 0x660]
push eax
mov ecx, dword [ebp - 0x904]
push ecx
mov edx, dword [ebp - 0xac]
push edx
mov eax, dword [ebp - 0xbc]
push eax
call fcn.00403590
add esp, 0x18
push str.Getting_current_user_information__n
call fcn.00407cf5
add esp, 4
push str.___sp_who
push str.sp_who
mov ecx, dword [ebp - 0x660]
push ecx
mov edx, dword [ebp - 0x904]
push edx
mov eax, dword [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0xbc]
push ecx
call fcn.00403360
add esp, 0x18
push str.Getting_lock_information__n
call fcn.00407cf5
add esp, 4
push str.___sp_lock
push str.sp_lock
mov edx, dword [ebp - 0x660]
push edx
mov eax, dword [ebp - 0x904]
push eax
mov ecx, dword [ebp - 0xac]
push ecx
mov edx, dword [ebp - 0xbc]
push edx
call fcn.00403360
add esp, 0x18
push str.Getting_database_information__n
call fcn.00407cf5
add esp, 4
push str.___sp_helpdb
push str.sp_helpdb
mov eax, dword [ebp - 0x660]
push eax
mov ecx, dword [ebp - 0x904]
push ecx
mov edx, dword [ebp - 0xac]
push edx
mov eax, dword [ebp - 0xbc]
push eax
call fcn.00403360
add esp, 0x18
push str.Getting_product_information__n
call fcn.00407cf5
add esp, 4
push str.___xp_msver
push str.xp_msver
mov ecx, dword [ebp - 0x660]
push ecx
mov edx, dword [ebp - 0x904]
push edx
mov eax, dword [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0xbc]
push ecx
call fcn.00403360
add esp, 0x18
push str.Getting_extended_procedures_information__n
call fcn.00407cf5
add esp, 4
push str.___sp_helpextendedproc
push str.sp_helpextendedproc
mov edx, dword [ebp - 0x660]
push edx
mov eax, dword [ebp - 0x904]
push eax
mov ecx, dword [ebp - 0xac]
push ecx
mov edx, dword [ebp - 0xbc]
push edx
call fcn.00403360
add esp, 0x18
push str.Getting_process_information__n
call fcn.00407cf5
add esp, 4
push str.___Sysprocesses
push str.select__from_sysprocesses
mov eax, dword [ebp - 0x660]
push eax
mov ecx, dword [ebp - 0x904]
push ecx
mov edx, dword [ebp - 0xac]
push edx
mov eax, dword [ebp - 0xbc]
push eax
call fcn.00403590
add esp, 0x18
push str.Getting_input_buffers__n
call fcn.00407cf5
add esp, 4
mov ecx, dword [ebp - 0x660]
push ecx
mov edx, dword [ebp - 0x904]
push edx
mov eax, dword [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0xbc]
push ecx
call fcn.00403710
add esp, 0x10
push str.Getting_head_blockers__n
call fcn.00407cf5
add esp, 4
push str.___Head_blockers
push str.declare__blocker_spid_smallint_declare__i_buff_string_char_30__set_nocount_on_select_spid__blocked__hostnamesubstring__hostname__1__10___prognamesubstring_program_name__1__10___cmdsubstring_cmd__1__10___status__physical_io__waittype_into_blk_from_master..sysprocesses__nolock__where_blocked___0_delete_from_blk_where_blocked_in__select_spid_from_blk__select_Blocking_spid__spid__loginamesubstring_loginame_1_10___hostnamesubstring__hostname__1__10___prognamesubstring_program_name__1__10___cmdsubstring_cmd__1__10___status__physical_io__waittype_from_master..sysprocesses__nolock__where_spid_in__select_blocked_from_blk__declare_blk_cursor_CURSOR_FOR_SELECT_blocked_from_blk_open_blk_cursor_fetch_next_from_blk_cursor_into__blocker_spid_while____fetch_status_____1__begin_select__i_buff_string___dbcc_inputbuffer____convert_char_6___blocker_spid_____select_Below_is_input_buffer_for_this_blocking_spid:____blocker_spid_select___exec___i_buff_string__fetch_next_from_blk_cursor_into__blocker_spid_end_deallocate_blk_cursor_drop_table_blk
mov edx, dword [ebp - 0x660]
push edx
mov eax, dword [ebp - 0x904]
push eax
mov ecx, dword [ebp - 0xac]
push ecx
mov edx, dword [ebp - 0xbc]
push edx
call fcn.00403590
add esp, 0x18
mov dword [ebp - 4], 0
jmp 0x402296
mov dword [ebp - 0xda8], 0x94
lea eax, [ebp - 0xda8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xd98], 2
jne 0x4022f9
cmp dword [ebp - 0xda4], 4
ja 0x4022dd
push str.Getting_machine_information__n
call fcn.00407cf5
add esp, 4
mov ecx, dword [ebp - 0xbc]
push ecx
call fcn.00404e20
add esp, 4
jmp 0x4022f9
push str.Getting_machine_information._Please_wait__this_may_take_a_few_minutes__n
call fcn.00407cf5
add esp, 4
mov edx, dword [ebp - 0xbc]
push edx
call fcn.00405130
add esp, 4
cmp dword [ebp - 0x258], 0
je 0x402434
push str.Retrieving_cluster_information__n
call fcn.00407cf5
add esp, 4
mov byte [ebp - 0x1238], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x1237]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1238]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x402377
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1344], eax
cmp dword [ebp - 0x1344], 0
je 0x402366
mov ecx, dword [ebp - 0x1344]
push ecx
call fcn.00405c70
add esp, 4
push 0
push 0
push 0
push 0xe0000101
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov byte [ebp - 0x1340], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x133f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x1340]
push edx
push 0
push 0x415f1c
lea eax, [ebp - 0x1238]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4023e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1348], eax
cmp dword [ebp - 0x1348], 0
je 0x4023d3
mov ecx, dword [ebp - 0x1348]
push ecx
call fcn.00405c70
add esp, 4
push 0
push 0
push 0
push 0xe0000101
call dword [sym.imp.KERNEL32.dll_RaiseException]
lea edx, [ebp - 0x148]
push edx
lea eax, [ebp - 0x1340]
push eax
call fcn.00406400
add esp, 8
test eax, eax
jne 0x40240f
push 0
push 0
push 0
push 0xe0000101
call dword [sym.imp.KERNEL32.dll_RaiseException]
push 0
lea ecx, [ebp - 0x1340]
push ecx
mov edx, dword [ebp - 0xbc]
push edx
call fcn.00402600
add esp, 0xc
lea eax, [ebp - 0x1340]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0xb8], 0
je 0x40250f
mov byte [ebp - 0x1450], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x144f]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x900]
push ecx
call fcn.00407800
add esp, 4
mov dword [ebp - 0x1454], eax
cmp dword [ebp - 0x1454], 4
jle 0x4024d1
push 0x415f20
mov edx, dword [ebp - 0x1454]
lea eax, [ebp + edx - 0x904]
push eax
call fcn.00407890
add esp, 8
test eax, eax
jne 0x4024d1
mov ecx, dword [ebp - 0x1454]
sub ecx, 4
push ecx
lea edx, [ebp - 0x900]
push edx
lea eax, [ebp - 0x1450]
push eax
call fcn.00407b20
add esp, 0xc
push 0x415f28
mov ecx, dword [ebp - 0x1454]
lea edx, [ebp + ecx - 0x1454]
push edx
call fcn.00407700
add esp, 8
jmp 0x4024fb
lea eax, [ebp - 0x900]
push eax
lea ecx, [ebp - 0x1450]
push ecx
call fcn.00407700
add esp, 8
push 0x415f30
lea edx, [ebp - 0x1450]
push edx
call fcn.00407710
add esp, 8
lea eax, [ebp - 0x1450]
push eax
push str.Last_100_Queries_Stored_in__s__n
call fcn.00407cf5
add esp, 8
lea ecx, [ebp - 0x900]
push ecx
push str.Data_Stored_in__s__n
call fcn.00407cf5
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x40253c
cmp dword [ebp - 0x660], 0
je 0x402553
mov edx, dword [ebp - 0x660]
push edx
push 3
call sub.ODBC32.dll_SQLFreeHandle
call fcn.00405ba0
cmp dword [ebp - 0xbc], 0
je 0x40257b
mov eax, dword [ebp - 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 0xbc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x20]
call fcn.00407d96
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret