Function at 0x409bc0
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x16e0
call fcn.0040cd20
mov eax, dword [0x412860]
mov dword [ebp - 4], eax
push edi
mov word [ebp - 0x10c8], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x10c6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x210], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x4b4], 0xffffffff
mov word [ebp - 0x8c8], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x8c6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x4b0], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x4ae]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x6c0], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x6be]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 0x10]
movzx ecx, word [eax]
test ecx, ecx
je 0x409c82
mov edx, dword [ebp + 0xc]
movzx eax, word [edx]
test eax, eax
je 0x409c82
mov ecx, dword [ebp + 8]
movzx edx, word [ecx]
test edx, edx
jne 0x409c89
xor eax, eax
jmp 0x40a036
lea eax, [ebp - 0x4b0]
push eax
lea ecx, [ebp - 0x8c8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00407640
add esp, 0xc
lea eax, [ebp - 0x6c0]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00407740
add esp, 0xc
push 0x411f8c
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [0x41301c]
call dword [ecx + 0x4bc]
test eax, eax
je 0x409cef
push 0x411fa4
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [0x41301c]
call dword [eax + 0x4bc]
test eax, eax
jne 0x409eff
mov dword [ebp - 0x10cc], 0
movzx ecx, word [ebp - 0x4b0]
test ecx, ecx
je 0x409d43
lea edx, [ebp - 0x4b0]
push edx
push str.SQL_Server_Instance__s
lea eax, [ebp - 0x12d0]
push eax
mov ecx, dword [0x41301c]
call dword [ecx + 0x4cc]
add esp, 0xc
lea edx, [ebp - 0x12d0]
push edx
mov eax, dword [0x4132dc]
push eax
call fcn.0040c2a0
add esp, 8
mov dword [ebp - 0x10cc], eax
jmp 0x409d5d
push 0x411fec
mov ecx, dword [0x4132dc]
push ecx
call fcn.0040c2a0
add esp, 8
mov dword [ebp - 0x10cc], eax
cmp dword [ebp + 0x14], 0
je 0x409eb5
cmp dword [ebp - 0x10cc], 0
jne 0x409eb5
push 0x41296c
lea edx, [ebp - 0x210]
push edx
mov eax, dword [0x41301c]
call dword [eax + 0x4c0]
push 0
lea ecx, [ebp - 0x2a0]
push ecx
push str.scm.exe
call dword [sym.imp.SQLUNIRL.dll__OpenFile__12]
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 0xffffffff
jne 0x409db5
xor eax, eax
jmp 0x40a036
push 0x104
lea edx, [ebp - 0x210]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x298]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x409dec
push 0x412970
lea ecx, [ebp - 0x210]
push ecx
call sub.MSVCR71.dll_wcscpy
add esp, 8
mov edx, dword [ebp - 0x4b4]
push edx
call dword [sym.imp.KERNEL32.dll__lclose]
movzx eax, word [ebp - 0x210]
test eax, eax
je 0x409eae
mov word [ebp - 0x16e0], 0
mov ecx, 0x103
xor eax, eax
lea edi, [ebp - 0x16de]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x6c0]
push ecx
lea edx, [ebp - 0x8c8]
push edx
push str._Action_1__Silent_1__Server__s__Service__s
lea eax, [ebp - 0x16e0]
push eax
mov ecx, dword [0x41301c]
call dword [ecx + 0x4cc]
add esp, 0x10
movzx edx, word [ebp - 0x4b0]
test edx, edx
je 0x409e83
lea eax, [ebp - 0x16e0]
push eax
push 0x412070
lea ecx, [ebp - 0x12d0]
push ecx
lea edx, [ebp - 0x210]
push edx
mov eax, dword [0x4132dc]
push eax
call fcn.00401010
add esp, 0x14
jmp 0x40a036
lea ecx, [ebp - 0x16e0]
push ecx
push str.Auto_Start_MS_SQL_Server_7.0
push 0x4120e8
lea edx, [ebp - 0x210]
push edx
mov eax, dword [0x4132dc]
push eax
call fcn.00401010
add esp, 0x14
jmp 0x40a036
xor eax, eax
jmp 0x40a036
cmp dword [ebp + 0x14], 0
jne 0x409efa
cmp dword [ebp - 0x10cc], 0
je 0x409efa
movzx ecx, word [ebp - 0x4b0]
test ecx, ecx
je 0x409ee6
lea edx, [ebp - 0x12d0]
push edx
mov eax, dword [0x4132dc]
push eax
call fcn.0040c3f0
add esp, 8
jmp 0x409efa
push 0x412100
mov ecx, dword [0x4132dc]
push ecx
call fcn.0040c3f0
add esp, 8
jmp 0x40a031
push 0x412118
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x41301c]
call dword [eax + 0x4bc]
test eax, eax
jne 0x40a02d
lea ecx, [ebp - 0x2a4]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
mov edx, dword [0x41301c]
call dword [edx + 0x3d4]
test eax, eax
je 0x409f4a
xor eax, eax
jmp 0x40a036
mov dword [ebp - 0x214], 0x7ff
cmp dword [ebp + 0x14], 0
je 0x409fce
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x10c8]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x2a4]
push eax
mov ecx, dword [0x41301c]
call dword [ecx + 0x3e4]
test eax, eax
je 0x409fce
push str.msdtcw__start
lea edx, [ebp - 0x10c8]
push edx
mov eax, dword [0x41301c]
call dword [eax + 0x4c0]
mov dword [ebp - 0x214], 0x7ff
push 4
lea ecx, [ebp - 0x10c8]
push ecx
push 1
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x2a4]
push eax
mov ecx, dword [0x41301c]
call dword [ecx + 0x3f8]
jmp 0x40a02b
cmp dword [ebp + 0x14], 0
jne 0x40a02b
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x10c8]
push eax
push 0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x2a4]
push edx
mov eax, dword [0x41301c]
call dword [eax + 0x3e4]
test eax, eax
jne 0x40a02b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x2a4]
push edx
mov eax, dword [0x41301c]
call dword [eax + 0x3a8]
test eax, eax
je 0x40a02b
mov ecx, dword [ebp - 0x2a4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40a036
jmp 0x40a031
xor eax, eax
jmp 0x40a036
mov eax, 1
mov ecx, dword [ebp - 4]
call fcn.0040cd05
pop edi
mov esp, ebp
pop ebp
ret