Function at 0x409706
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16c8
call fcn.0040c300
push edi
mov word [ebp - 0x800], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x7fe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0xc10], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xc0e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0xea8], 0xffffffff
mov word [ebp - 0xa08], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xa06]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x10b4], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x10b2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0xea0], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xe9e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax]
test ecx, ecx
je 0x4097c4
mov edx, dword [ebp + 0xc]
xor eax, eax
mov ax, word [edx]
test eax, eax
je 0x4097c4
mov ecx, dword [ebp + 8]
xor edx, edx
mov dx, word [ecx]
test edx, edx
jne 0x4097cb
xor eax, eax
jmp 0x409b8b
lea eax, [ebp - 0x10b4]
push eax
lea ecx, [ebp - 0xa08]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00407227
add esp, 0xc
lea eax, [ebp - 0xea0]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00407319
add esp, 0xc
push 0x41001c
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [0x41109c]
call dword [ecx + 0x4bc]
test eax, eax
je 0x409831
push 0x410034
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [0x41109c]
call dword [eax + 0x4bc]
test eax, eax
jne 0x409a54
mov dword [ebp - 0x12b8], 0
mov ecx, dword [ebp - 0x10b4]
and ecx, 0xffff
test ecx, ecx
je 0x40988a
lea edx, [ebp - 0x10b4]
push edx
push str.SQL_Server_Instance__s
lea eax, [ebp - 0x12b4]
push eax
mov ecx, dword [0x41109c]
call dword [ecx + 0x4cc]
add esp, 0xc
lea edx, [ebp - 0x12b4]
push edx
mov eax, dword [0x41135c]
push eax
call fcn.0040bc6b
add esp, 8
mov dword [ebp - 0x12b8], eax
jmp 0x4098a4
push 0x41007c
mov ecx, dword [0x41135c]
push ecx
call fcn.0040bc6b
add esp, 8
mov dword [ebp - 0x12b8], eax
cmp dword [ebp + 0x14], 0
je 0x409a05
cmp dword [ebp - 0x12b8], 0
jne 0x409a05
push 0x4109ec
lea edx, [ebp - 0xc10]
push edx
mov eax, dword [0x41109c]
call dword [eax + 0x4c0]
push 0
lea ecx, [ebp - 0xc98]
push ecx
push str.scm.exe
call dword [sym.imp.SQLUNIRL.dll__OpenFile__12]
mov dword [ebp - 0xea8], eax
cmp dword [ebp - 0xea8], 0xffffffff
jne 0x4098fc
xor eax, eax
jmp 0x409b8b
push 0x104
lea edx, [ebp - 0xc10]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0xc90]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x409933
push 0x4109f0
lea ecx, [ebp - 0xc10]
push ecx
call sub.MSVCRT.dll_wcscpy
add esp, 8
mov edx, dword [ebp - 0xea8]
push edx
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [ebp - 0xc10]
and eax, 0xffff
test eax, eax
je 0x4099fe
mov word [ebp - 0x16c8], 0
mov ecx, 0x103
xor eax, eax
lea edi, [ebp - 0x16c6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0xea0]
push ecx
lea edx, [ebp - 0xa08]
push edx
push str._Action_1__Silent_1__Server__s__Service__s
lea eax, [ebp - 0x16c8]
push eax
mov ecx, dword [0x41109c]
call dword [ecx + 0x4cc]
add esp, 0x10
mov edx, dword [ebp - 0x10b4]
and edx, 0xffff
test edx, edx
je 0x4099d3
lea eax, [ebp - 0x16c8]
push eax
push 0x4100fc
lea ecx, [ebp - 0x12b4]
push ecx
lea edx, [ebp - 0xc10]
push edx
mov eax, dword [0x41135c]
push eax
call section..text
add esp, 0x14
jmp 0x409b8b
lea ecx, [ebp - 0x16c8]
push ecx
push str.Auto_Start_MS_SQL_Server_7.0
push 0x410174
lea edx, [ebp - 0xc10]
push edx
mov eax, dword [0x41135c]
push eax
call section..text
add esp, 0x14
jmp 0x409b8b
xor eax, eax
jmp 0x409b8b
cmp dword [ebp + 0x14], 0
jne 0x409a4f
cmp dword [ebp - 0x12b8], 0
je 0x409a4f
mov ecx, dword [ebp - 0x10b4]
and ecx, 0xffff
test ecx, ecx
je 0x409a3b
lea edx, [ebp - 0x12b4]
push edx
mov eax, dword [0x41135c]
push eax
call fcn.0040bd8d
add esp, 8
jmp 0x409a4f
push 0x41018c
mov ecx, dword [0x41135c]
push ecx
call fcn.0040bd8d
add esp, 8
jmp 0x409b86
push 0x4101a4
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x41109c]
call dword [eax + 0x4bc]
test eax, eax
jne 0x409b82
lea ecx, [ebp - 0xeac]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
mov edx, dword [0x41109c]
call dword [edx + 0x3d4]
test eax, eax
je 0x409a9f
xor eax, eax
jmp 0x409b8b
mov dword [ebp - 0xea4], 0x7ff
cmp dword [ebp + 0x14], 0
je 0x409b23
lea eax, [ebp - 0xea4]
push eax
lea ecx, [ebp - 0x800]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xeac]
push eax
mov ecx, dword [0x41109c]
call dword [ecx + 0x3e4]
test eax, eax
je 0x409b23
push str.msdtcw__start
lea edx, [ebp - 0x800]
push edx
mov eax, dword [0x41109c]
call dword [eax + 0x4c0]
mov dword [ebp - 0xea4], 0x7ff
push 4
lea ecx, [ebp - 0x800]
push ecx
push 1
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xeac]
push eax
mov ecx, dword [0x41109c]
call dword [ecx + 0x3f8]
jmp 0x409b80
cmp dword [ebp + 0x14], 0
jne 0x409b80
lea edx, [ebp - 0xea4]
push edx
lea eax, [ebp - 0x800]
push eax
push 0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xeac]
push edx
mov eax, dword [0x41109c]
call dword [eax + 0x3e4]
test eax, eax
jne 0x409b80
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xeac]
push edx
mov eax, dword [0x41109c]
call dword [eax + 0x3a8]
test eax, eax
je 0x409b80
mov ecx, dword [ebp - 0xeac]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x409b8b
jmp 0x409b86
xor eax, eax
jmp 0x409b8b
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret