Function at 0x4068f0
Capabilities:
Query service status
Start service

Disassembly:
mov eax, 0x1cd8
call fcn.0040c540
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1cd4], eax
mov eax, dword [esp + 0x1cdc]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, ecx
mov dword [esp + 0x24], eax
push esi
xor eax, eax
lea ecx, [ebx + 6]
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ecx
mov edi, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push 0xf0000
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [esp + 0x24], esi
test esi, esi
je 0x40704c
mov eax, dword [str.SQLDUMPER_]
mov dword [esp + 0xac], eax
mov eax, dword [0x410648]
mov dword [esp + 0xb0], eax
mov eax, dword [0x41064c]
mov dword [esp + 0xb4], eax
mov eax, dword [0x410650]
mov dword [esp + 0xb8], eax
mov eax, dword [0x410654]
mov dword [esp + 0xbc], eax
mov ax, word [0x410658]
push 0x3fc
mov word [esp + 0xc4], ax
lea eax, [esp + 0xc6]
push 0
push eax
call sub.MSVCR100.dll_memset
lea ebp, [ebx + 0x316]
push 0x5c
push ebp
call dword [sym.imp.MSVCR100.dll_wcsrchr]
add esp, 0x14
test eax, eax
je 0x4069c9
lea ebp, [eax + 2]
mov ecx, 0x209
lea eax, [esp + 0xac]
xor ebx, ebx
cmp word [eax], bx
je 0x4069eb
add eax, 2
dec ecx
jne 0x4069d7
mov ebx, 0x80070057
xor edx, edx
jmp 0x4069ff
test ecx, ecx
jne 0x4069f8
mov ebx, 0x80070057
xor edx, edx
jmp 0x4069ff
mov edx, 0x209
sub edx, ecx
test ebx, ebx
js 0x406a5d
mov ecx, 0x209
lea eax, [esp + 0xac]
lea eax, [eax + edx*2]
mov ebx, 0
sub ecx, edx
je 0x406a44
lea esi, [edx + 0x7ffffdf5]
mov edi, ebp
add esi, ecx
sub edi, eax
test esi, esi
je 0x406a40
movzx edx, word [eax + edi]
test dx, dx
je 0x406a40
mov word [eax], dx
add eax, 2
dec esi
dec ecx
jne 0x406a27
jmp 0x406a44
test ecx, ecx
jne 0x406a4c
sub eax, 2
mov ebx, 0x8007007a
mov esi, dword [esp + 0x24]
mov edi, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
xor ecx, ecx
mov word [eax], cx
test ebx, ebx
jne 0x407029
push 0x80000010
lea eax, [esp + 0xb0]
push eax
push esi
call edi
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x406a96
push 0x80000010
push str.SQLDUMPER
push esi
call edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x407000
mov eax, dword [0x40d330]
mov dword [esp + 0x14], eax
mov eax, dword [0x410700]
mov dword [esp + 0x4c0], eax
mov ax, word [0x410704]
push 0x40c
mov word [esp + 0x4c8], ax
lea eax, [esp + 0x4ca]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov ecx, 0x209
lea eax, [esp + 0x4c0]
xor edi, edi
mov edi, edi
cmp word [eax], di
je 0x406af4
add eax, 2
dec ecx
jne 0x406ae0
mov edi, 0x80070057
xor edx, edx
jmp 0x406b08
test ecx, ecx
jne 0x406b01
mov edi, 0x80070057
xor edx, edx
jmp 0x406b08
mov edx, 0x209
sub edx, ecx
test edi, edi
js 0x406b5c
mov ecx, 0x209
lea eax, [esp + 0x4c0]
lea eax, [eax + edx*2]
mov edi, 0
sub ecx, edx
je 0x406b4d
lea esi, [edx + 0x7ffffdf5]
add esi, ecx
sub ebp, eax
mov edi, edi
test esi, esi
je 0x406b49
movzx edx, word [eax + ebp]
test dx, dx
je 0x406b49
mov word [eax], dx
add eax, 2
dec esi
dec ecx
jne 0x406b30
jmp 0x406b4d
test ecx, ecx
jne 0x406b55
sub eax, 2
mov edi, 0x8007007a
xor ecx, ecx
mov word [eax], cx
test edi, edi
jne 0x407022
mov ebp, dword [esp + 0x2c]
push dword [ebp + 0x654]
mov eax, 0x20
push dword [ebp + 0x115c]
lea edi, [esp + 0x74]
push str._X:_X
call fcn.00401210
add esp, 0xc
test eax, eax
jne 0x40701b
mov ecx, 0xe
mov esi, str._remoteservers:remoteinvoke:
lea edi, [esp + 0x8d4]
rep movsd dword es:[edi], dword [esi]
push 0x7c6
push eax
lea eax, [esp + 0x916]
push eax
movsw word es:[edi], word [esi]
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea eax, [ebp + 0x1da14]
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
jne 0x407014
mov ecx, 0x400
lea eax, [esp + 0x8d4]
xor ebx, ebx
jmp 0x406bf0
cmp word [eax], bx
je 0x406c04
add eax, 2
dec ecx
jne 0x406bf0
mov ebx, 0x80070057
xor edx, edx
jmp 0x406c18
test ecx, ecx
jne 0x406c11
mov ebx, 0x80070057
xor edx, edx
jmp 0x406c18
mov edx, 0x400
sub edx, ecx
test ebx, ebx
js 0x406c6c
mov ecx, 0x400
lea eax, [esp + 0x8d4]
lea eax, [eax + edx*2]
mov ebx, 0
sub ecx, edx
je 0x406c5f
mov edi, dword [esp + 0x18]
lea esi, [edx + 0x7ffffbfe]
add esi, ecx
sub edi, eax
test esi, esi
je 0x406c5b
movzx edx, word [eax + edi]
test dx, dx
je 0x406c5b
mov word [eax], dx
add eax, 2
dec esi
dec ecx
jne 0x406c42
jmp 0x406c5f
test ecx, ecx
jne 0x406c67
sub eax, 2
mov ebx, 0x8007007a
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
test ebx, ebx
jne 0x40700d
mov eax, dword [ebp + 0x1da0c]
and eax, 0xffffffde
push eax
mov eax, dword [esp + 0x24]
movzx eax, word [eax + 4]
push eax
push dword [ebp + 0x1da24]
lea eax, [ebp + 0x1da28]
push dword [ebp + 0x698]
lea edi, [esp + 0x10e4]
push eax
push str._s_X_d_d_d
mov eax, 0x208
call fcn.00401210
add esp, 0x18
test eax, eax
jne 0x40700d
mov ecx, 0x400
lea eax, [esp + 0x8d4]
cmp word [eax], bx
je 0x406ce6
add eax, 2
dec ecx
jne 0x406cd2
mov ebx, 0x80070057
xor edx, edx
jmp 0x406cfa
test ecx, ecx
jne 0x406cf3
mov ebx, 0x80070057
xor edx, edx
jmp 0x406cfa
mov edx, 0x400
sub edx, ecx
test ebx, ebx
js 0x406d53
mov ecx, 0x400
lea eax, [esp + 0x8d4]
lea eax, [eax + edx*2]
mov ebx, 0
sub ecx, edx
je 0x406d44
lea esi, [edx + 0x7ffffbfe]
lea edi, [esp + 0x10d4]
add esi, ecx
sub edi, eax
test esi, esi
je 0x406d40
movzx edx, word [eax + edi]
test dx, dx
je 0x406d40
mov word [eax], dx
add eax, 2
dec esi
dec ecx
jne 0x406d27
jmp 0x406d44
test ecx, ecx
jne 0x406d4c
sub eax, 2
mov ebx, 0x8007007a
xor ecx, ecx
mov word [eax], cx
test ebx, ebx
jne 0x40700d
lea eax, [esp + 0x14]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x4c0]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x6c]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x8d4]
push eax
mov dword [esp + 0x48], eax
lea eax, [esp + 0x70]
push eax
push str._SMSSQLSERVER
lea eax, [esp + 0x4cc]
push eax
lea eax, [esp + 0x24]
push eax
push eax
push dword [esp + 0x34]
mov ebx, 0x415428
push str.Remote_dump_on__s_invoked_with_parameters__s__s__s__s__s__s
push 2
mov dword [esp + 0x60], str._SMSSQLSERVER
call fcn.00401660
mov ebx, dword [esp + 0x34]
mov edi, dword [sym.imp.ADVAPI32.dll_StartServiceW]
add esp, 0x24
lea eax, [esp + 0x30]
push eax
push 6
push ebx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
jne 0x406e70
call ebp
cmp eax, 0x420
jne 0x406e01
push 0x64
call esi
lea eax, [esp + 0x30]
push eax
push 6
push ebx
call edi
test eax, eax
je 0x406de4
jmp 0x406e70
call ebp
call ebp
push 0
push 0x400
mov esi, eax
lea eax, [esp + 0x14ec]
push eax
push 0x400
push esi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov ebx, 0x415428
test eax, eax
je 0x406e51
lea eax, [esp + 0x14e4]
push eax
push esi
push str.Unable_to_start_service
push str._s_0x_x____ls
push 1
call fcn.00401660
add esp, 0x14
jmp 0x406e66
push esi
push str.Unable_to_start_service
push str._s_0x_x
push 1
call fcn.00401660
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
lea eax, [esp + 0x28]
push eax
push 0x24
lea eax, [esp + 0x50]
push eax
push 0
push ebx
mov dword [esp + 0x3c], 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x406f43
mov ecx, dword [esp + 0x4c]
mov eax, ecx
sub eax, 2
je 0x406ef2
sub eax, 2
je 0x406ef2
sub eax, 0xc
jne 0x406fc2
push 0x64
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
call esi
jmp 0x406eb8
call ebp
mov esi, eax
test esi, esi
jle 0x406f57
and esi, 0xffff
or esi, 0x80070000
call ebp
push 0
push 0x400
mov edi, eax
lea eax, [esp + 0x14ec]
push eax
push 0x400
push edi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov ebx, 0x415428
test eax, eax
je 0x406fa5
lea eax, [esp + 0x14e4]
push eax
push edi
push str.Unable_to_query_service_state
push str._s_0x_x____ls
push 1
call fcn.00401660
add esp, 0x14
jmp 0x406fba
push edi
push str.Unable_to_query_service_state
push str._s_0x_x
push 1
call fcn.00401660
add esp, 0x10
test esi, esi
jne 0x406feb
mov ecx, dword [esp + 0x4c]
push dword [esp + 0x5c]
mov ebx, 0x415428
push dword [esp + 0x68]
push dword [esp + 0x5c]
push ecx
push dword [esp + 0x68]
push dword [esp + 0x30]
push str.Remote_dump_on__s_completed_with_status__X__state__X__exitCode__X__process__d__step__d_
push 2
call fcn.00401660
add esp, 0x20
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x407033
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
jmp 0x406930
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, str.Unable_to_locate_specific_SQLDUMPER_service
jmp 0x40702e
mov edi, str.Unable_to_construct_launch_parameter
jmp 0x40702e
mov edi, str.Unable_to_serialize_guid
jmp 0x40702e
mov edi, str.Unable_to_prepare_dumper_flags
jmp 0x40702e
mov edi, str.Instance_name_too_long
jmp 0x40702e
mov edi, str.Service_name_too_long
call fcn.00406520
push dword [esp + 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x407078
push eax
call esi
jmp 0x407078
call ebp
mov esi, eax
test esi, esi
jle 0x407060
and esi, 0xffff
or esi, 0x80070000
mov edi, str.Unable_to_open_SCM_on_remote_box
call fcn.00406520
test esi, esi
je 0x407078
or dword [0x415054], 0x20008000
mov ecx, dword [esp + 0x1ce4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040bb9d
add esp, 0x1cd8
ret 4