Function at 0x401bf0
Capabilities:
Create service
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe84
mov eax, dword [0x410060]
mov dword [ebp - 4], eax
push edi
mov word [ebp - 0x828], 0
mov ecx, 0x103
xor eax, eax
lea edi, [ebp - 0x826]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0xc58], 0
mov ecx, 0x104
xor eax, eax
lea edi, [ebp - 0xc56]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0xe70], 0
mov ecx, 0x83
xor eax, eax
lea edi, [ebp - 0xe6e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x418], 0
mov ecx, 0x103
xor eax, eax
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0xc5c], 0
mov dword [ebp - 0xe74], 0
mov dword [ebp - 0x83c], 0
mov dword [ebp - 0x834], 0
lea eax, [ebp - 0x83c]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0
jne 0x401d2d
mov dword [ebp - 0xe7c], 0x104
lea ecx, [ebp - 0xe7c]
push ecx
lea edx, [ebp - 0x828]
push edx
lea eax, [ebp - 0x830]
push eax
push 0
push str.ProgramFilesDir
mov ecx, dword [ebp - 0x83c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x834], eax
mov word [ebp - 0x620], 0x30
mov edx, dword [ebp - 0x83c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x834], 0
je 0x401d2b
push str.Cannot_query_ProgramFilesDir_value_n
call sub.MSVCR71.dll_wprintf
add esp, 4
jmp 0x401f83
jmp 0x401d3f
push str.Cannot_open_windows_currentversion_key_n
call sub.MSVCR71.dll_wprintf
add esp, 4
jmp 0x401f83
push str.Microsoft_SQL_Server_
lea eax, [ebp - 0x828]
push eax
call sub.MSVCR71.dll_wcscat
add esp, 8
push 0x40a540
lea ecx, [ebp - 0x828]
push ecx
call sub.MSVCR71.dll_wcscat
add esp, 8
push str.ToolsBinn_
lea edx, [ebp - 0x828]
push edx
call sub.MSVCR71.dll_wcscat
add esp, 8
lea eax, [ebp - 0x828]
push eax
lea ecx, [ebp - 0x418]
push ecx
call sub.MSVCR71.dll_wcscpy
add esp, 8
push str.sqladhlp.exe
lea edx, [ebp - 0x828]
push edx
call sub.MSVCR71.dll_wcscat
add esp, 8
push str.Resources_
lea eax, [ebp - 0x418]
push eax
call sub.MSVCR71.dll_wcscat
add esp, 8
cmp dword [ebp + 8], 0
je 0x401dca
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xe80], ecx
jmp 0x401dd4
mov dword [ebp - 0xe80], str.1033
mov edx, dword [ebp - 0xe80]
push edx
lea eax, [ebp - 0x418]
push eax
call sub.MSVCR71.dll_wcscat
add esp, 8
push 0x40a548
lea ecx, [ebp - 0x418]
push ecx
call sub.MSVCR71.dll_wcscat
add esp, 8
push str.sqladevn.rll
lea edx, [ebp - 0x418]
push edx
call sub.MSVCR71.dll_wcscat
add esp, 8
movzx eax, word [ebp - 0x828]
xor ecx, ecx
cmp eax, 0x22
setne cl
mov dword [ebp - 0x82c], ecx
cmp dword [ebp - 0x82c], 0
je 0x401e3c
mov dword [ebp - 0xe84], 0x40a54c
jmp 0x401e46
mov dword [ebp - 0xe84], 0x40a558
mov edx, dword [ebp - 0xe84]
mov dword [ebp - 0xc60], edx
lea eax, [ebp - 0x828]
push eax
mov ecx, dword [ebp - 0xc60]
push ecx
push 0x20a
lea edx, [ebp - 0xc58]
push edx
call fcn.00402230
add esp, 0x10
test eax, eax
jge 0x401e8a
push str.Cannot_perform_StringCChPrintf____n
call sub.MSVCR71.dll_wprintf
add esp, 4
jmp 0x401f83
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0xe78], eax
cmp dword [ebp - 0xe78], 0
je 0x401f5a
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc58]
push eax
push 1
push 3
push 0x10
push 0xf01ff
push str.MSSQLServerADHelper
push str.MSSQLServerADHelper
mov ecx, dword [ebp - 0xe78]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x838], 0
je 0x401f22
lea edx, [ebp - 0x418]
push edx
call fcn.00401a40
add esp, 4
test eax, eax
jne 0x401f13
push str.MSSQLServerADHelper
push str._s_installed._n
call sub.MSVCR71.dll_wprintf
add esp, 8
mov eax, dword [ebp - 0x838]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x401f4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x104
lea ecx, [ebp - 0xe70]
push ecx
call fcn.00402190
add esp, 0xc
push eax
push str.CreateService_failed____s_n
call sub.MSVCR71.dll_wprintf
add esp, 8
mov edx, dword [ebp - 0xe78]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x401f83
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x104
lea eax, [ebp - 0xe70]
push eax
call fcn.00402190
add esp, 0xc
push eax
push 0x40a600
call sub.MSVCR71.dll_wprintf
add esp, 8
mov ecx, dword [ebp - 4]
call fcn.00409559
pop edi
mov esp, ebp
pop ebp
ret