Function at 0x401930
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x40feb8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0xc], 1
jb 0x40198b
cmp dword [ebp + 0xc], 3
jbe 0x401995
mov eax, 0x80070057
jmp 0x401b81
cmp dword [ebp + 8], 0
je 0x4019b0
mov eax, dword [ebp + 8]
add eax, 0x820
push eax
call sub.MSVCR71.dll_wcslen
add esp, 4
test eax, eax
ja 0x4019ba
mov eax, 0x80070057
jmp 0x401b81
mov ecx, dword [ebp + 8]
add ecx, 0x820
mov dword [ebp - 0x34], ecx
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x30], edx
push 0xa
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCR71.dll__ultow
add esp, 0xc
push 0x80020001
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x401a01
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401b81
push 0x14
push str.MSSQLServerADHelper
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401a29
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x401b5e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.00405330
add esp, 8
lea edx, [ebp - 0x5c]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x401ab0
cmp dword [ebp - 0x58], 1
je 0x401a6c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401a6e
jmp 0x401ab0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
cmp ecx, dword [ebp - 0x38]
jae 0x401a91
or edx, 0xffffffff
sub edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x60]
lea ecx, [eax + edx + 1]
mov dword [ebp - 0xc], ecx
jmp 0x401a9a
mov edx, dword [ebp - 0x60]
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jbe 0x401aae
mov dword [ebp - 4], 0x20000006
jmp 0x401b5e
jmp 0x401a42
cmp dword [ebp - 0x40], 0
jne 0x401ac4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x401b5e
lea ecx, [ebp - 0x34]
push ecx
push 2
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x401ae3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x401b5e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x5c]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x401b57
cmp dword [ebp - 0x58], 1
je 0x401b16
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401b18
jmp 0x401b57
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x60], eax
mov edx, dword [ebp - 0x60]
cmp edx, dword [ebp - 0x38]
jae 0x401b3b
or eax, 0xffffffff
sub eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x60]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0xc], edx
jmp 0x401b44
mov eax, dword [ebp - 0x60]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x10]
jbe 0x401b55
mov dword [ebp - 4], 0x20000006
jmp 0x401b5e
jmp 0x401aec
mov dword [ebp - 4], 0
cmp dword [ebp - 8], 0
je 0x401b6e
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x3c], 0
je 0x401b7e
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
call fcn.00408ef1
mov esp, ebp
pop ebp
ret