Function at 0x401976
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x30], 0
cmp dword [ebp + 0xc], 1
jb 0x4019c7
cmp dword [ebp + 0xc], 3
jbe 0x4019d1
mov eax, 0x80070057
jmp 0x401bcc
cmp dword [ebp + 8], 0
je 0x4019ec
mov eax, dword [ebp + 8]
add eax, 0x820
push eax
call sub.MSVCRT.dll_wcslen
add esp, 4
test eax, eax
ja 0x4019f6
mov eax, 0x80070057
jmp 0x401bcc
mov ecx, dword [ebp + 8]
add ecx, 0x820
mov dword [ebp - 0x3c], ecx
lea edx, [ebp - 0x58]
mov dword [ebp - 0x38], edx
push 0xa
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll__ultow
add esp, 0xc
push 0x80020001
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x401a3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401bcc
push 0x14
push str.MSSQLServerADHelper
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x401a65
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40], eax
jmp 0x401bca
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.00404777
add esp, 8
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x401aec
cmp dword [ebp - 0x20], 1
je 0x401aa8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401aaa
jmp 0x401aec
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x34]
jae 0x401acd
or edx, 0xffffffff
sub edx, dword [ebp - 0x34]
mov eax, dword [ebp - 8]
lea ecx, [eax + edx + 1]
mov dword [ebp - 4], ecx
jmp 0x401ad6
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x34]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x30]
jbe 0x401aea
mov dword [ebp - 0x40], 0x20000006
jmp 0x401bc8
jmp 0x401a7e
cmp dword [ebp - 0x5c], 0
jne 0x401b00
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40], eax
jmp 0x401bc6
lea ecx, [ebp - 0x3c]
push ecx
push 2
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x401b22
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40], eax
jmp 0x401bc4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x401b96
cmp dword [ebp - 0x20], 1
je 0x401b55
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401b57
jmp 0x401b96
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x34]
jae 0x401b7a
or eax, 0xffffffff
sub eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax + 1]
mov dword [ebp - 4], edx
jmp 0x401b83
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x30]
jbe 0x401b94
mov dword [ebp - 0x40], 0x20000006
jmp 0x401bc2
jmp 0x401b2b
mov dword [ebp - 0x40], 0
cmp dword [ebp - 0x28], 0
je 0x401bad
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x2c], 0
je 0x401bbd
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x40]
jmp 0x401bcc
jmp 0x401b9d
jmp 0x401b9d
jmp 0x401b9d
jmp 0x401b9d
jmp 0x401b9d
mov esp, ebp
pop ebp
ret