Function at 0x406df0
Capabilities:
Create thread
Resume thread
Suspend thread

Disassembly:
sub esp, 0x818
mov eax, dword [0x429008]
xor eax, esp
mov dword [esp + 0x814], eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x1c], esi
cmp dword [esi + 0x2dc9c], 0
je 0x407143
test byte [esi + 0x2dc98], 4
jne 0x406e42
push str.Dump_operation_is_not_requested
push 2
push 0x429048
call fcn.00404d90
add esp, 0xc
mov eax, 1
jmp 0x407145
cmp dword [esp + 0x82c], 0
je 0x406f23
push 0
push 0
push 1
push 0
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [esi + 0x2dee8], eax
test eax, eax
jne 0x406ed6
call dword [sym.imp.kernel32.dll_GetLastError]
push 0
push 0x400
mov esi, eax
lea eax, [esp + 0x28]
push eax
push 0x400
push esi
push 0
push 0x1000
call dword [sym.imp.kernel32.dll_FormatMessageW]
test eax, eax
je 0x406eb7
lea ecx, [esp + 0x20]
push ecx
push esi
push str.Unable_to_create_service_event
push str._s_0x_x____ls
push 1
push 0x429048
call fcn.00404d90
add esp, 0x18
jmp 0x407143
push esi
push str.Unable_to_create_service_event
push str._s_0x_x
push 1
push 0x429048
call fcn.00404d90
add esp, 0x14
jmp 0x407143
lea eax, [esp + 0x18]
push eax
push 0
push esi
push 0x40cee0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [esi + 0x2deec], eax
test eax, eax
jne 0x406f23
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push str.Unable_to_create_thread_for_service_handler___d_.
push 1
push 0x429048
call fcn.00404d90
add esp, 0x10
push dword [esi + 0x2dee8]
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x407143
push 0x22c
lea eax, [esi + 0x2dca0]
push eax
push str.DmpRemoteDumpRequest
push str.sqlservr.exe
push dword [esi]
lea ebp, [esi + 0x2dedc]
mov ecx, ebp
call fcn.0040cd70
test eax, eax
je 0x4070b8
xor esi, esi
mov dword [esp + 0x14], 1
xor ebx, ebx
xor edi, edi
nop
test edi, edi
jne 0x406f8e
push 0x64
push dword [ebp + 4]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x406f7e
cmp eax, 0x102
je 0x406fdb
mov dword [esp + 0x14], edi
mov edi, 1
mov eax, esi
sub eax, ebx
cmp eax, 0x7530
jb 0x406f60
lea eax, [esp + 0x18]
mov dword [esp + 0x10], esi
push eax
push dword [ebp + 4]
mov dword [esp + 0x20], 0
call dword [sym.imp.kernel32.dll_GetExitCodeThread]
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
test edi, edi
je 0x407038
test eax, eax
je 0x407038
push dword [esp + 0x18]
push ebx
push dword [esp + 0x18]
push str.Injected_thread_completed_after_waiting_for__d_msec___d_suspended___ret_code___X
push 2
push 0x429048
call fcn.00404d90
add esp, 0x18
jmp 0x407051
push dword [ebp + 4]
add esi, 0x64
call dword [sym.imp.kernel32.dll_SuspendThread]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x406f83
push dword [ebp + 4]
call dword [sym.imp.kernel32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x407025
mov edi, 1
mov dword [esp + 0x14], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push str.Unable_to_resume_injected_thread___d_
push edi
push 0x429048
call fcn.00404d90
add esp, 0x10
cmp dword [esp + 0x10], 2
jbe 0x406f83
add ebx, 0x64
jmp 0x406f83
push ebx
push dword [esp + 0x14]
push str.Wait_for_injected_thread_exited_after_waiting_for__d_msec___d_suspended_
push 1
push 0x429048
call fcn.00404d90
add esp, 0x14
mov eax, dword [ebp + 4]
test eax, eax
je 0x40705f
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp + 8]
test eax, eax
je 0x407096
push 0x8000
push 0
push eax
push dword [ebp]
call dword [sym.imp.kernel32.dll_VirtualFreeEx]
test eax, eax
jne 0x407096
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push str.Unable_to_free_parameter_block__x
push 1
push 0x429048
call fcn.00404d90
add esp, 0x10
test edi, edi
je 0x4070b8
push str.Dump_was_completed_using_in_proc_activation
push 2
push 0x429048
call fcn.00404d90
add esp, 0xc
mov eax, 1
jmp 0x407145
mov eax, dword [esi + 0xe7e4]
or eax, 0x20
mov dword [esi + 0xe7e4], eax
test eax, 0x800
je 0x4070e3
and eax, 0xfffff7ff
or dword [esi + 0xe7e8], 0x1160
mov dword [esi + 0xe7e4], eax
test al, 0x10
je 0x4070f7
and eax, 0xffffffef
or dword [esi + 0xe7e8], 2
mov dword [esi + 0xe7e4], eax
test al, 8
je 0x40710b
and eax, 0xfffffff7
or dword [esi + 0xe7e8], 0x40
mov dword [esi + 0xe7e4], eax
test eax, 0x1000
je 0x407127
and eax, 0xffffefff
or dword [esi + 0xe7e8], 0x1826
mov dword [esi + 0xe7e4], eax
test eax, 0x8000
je 0x407143
or eax, 0x8020
or dword [esi + 0xe7e8], 0x1826
mov dword [esi + 0xe7e4], eax
xor eax, eax
mov ecx, dword [esp + 0x824]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00414600
add esp, 0x818
ret 4