Function at 0x4082d0
Capabilities:
Query service status
Resolve function by parsing pe exports
Start service

Disassembly:
mov eax, 0x1ce0
call fcn.0040f3f0
mov eax, dword [0x41b008]
xor eax, esp
mov dword [esp + 0x1cdc], eax
push ebx
mov ebx, dword [sym.imp.kernel32.dll_GetLastError]
push ebp
push esi
mov esi, dword [esp + 0x1cf0]
xor ebp, ebp
mov dword [esp + 0x20], ecx
push edi
mov dword [esp + 0x1c], esi
lea ecx, [esi + 6]
mov dword [esp + 0x18], ecx
nop word [eax + eax]
push 0xf0000
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [esp + 0x20], eax
test eax, eax
je 0x4089d8
mov eax, dword [0x4147fc]
movups xmm0, xmmword [str.SQLDUMPER_]
mov dword [esp + 0xb8], eax
mov ax, word [0x414800]
push 0x3fc
mov word [esp + 0xc0], ax
lea eax, [esp + 0xc2]
push 0
push eax
movups xmmword [esp + 0xb4], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ebx, [esi + 0x316]
push 0x5c
push ebx
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x408383
lea ebx, [eax + 2]
mov ecx, 0x209
lea eax, [esp + 0xa8]
nop
cmp word [eax], 0
je 0x40839e
add eax, 2
sub ecx, 1
jne 0x408390
mov eax, 0x209
mov edi, ecx
sub eax, ecx
mov esi, 0x80070057
neg edi
sbb edi, edi
and edi, eax
xor eax, eax
test ecx, ecx
cmovne esi, eax
je 0x408409
mov edx, 0x209
lea ecx, [esp + 0xa8]
lea ecx, [ecx + edi*2]
sub edx, edi
je 0x4083f0
mov edi, ebx
mov esi, 0x7ffffffe
sub edi, ecx
test esi, esi
je 0x4083f0
movzx eax, word [edi + ecx]
test ax, ax
je 0x4083f0
mov word [ecx], ax
dec esi
add ecx, 2
sub edx, 1
jne 0x4083d7
test edx, edx
lea eax, [ecx - 2]
mov esi, 0x8007007a
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
xor eax, eax
test edx, edx
cmovne esi, eax
test esi, esi
jne 0x4089b9
mov esi, dword [esp + 0x20]
lea eax, [esp + 0xa8]
mov edi, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push 0x80000010
push eax
push esi
call edi
mov ebp, eax
test ebp, ebp
jne 0x408448
push 0x80000010
push str.SQLDUMPER
push esi
call edi
mov ebp, eax
test ebp, ebp
je 0x40897c
mov eax, dword [0x410ab0]
mov dword [esp + 0x10], eax
mov eax, dword [0x4148a8]
mov dword [esp + 0x4c0], eax
mov ax, word [0x4148ac]
push 0x40c
mov word [esp + 0x4c8], ax
lea eax, [esp + 0x4ca]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x4c0]
mov ecx, 0x209
nop
cmp word [eax], 0
je 0x40849e
add eax, 2
sub ecx, 1
jne 0x408490
mov eax, 0x209
mov edi, ecx
sub eax, ecx
mov esi, 0x80070057
neg edi
sbb edi, edi
and edi, eax
xor eax, eax
test ecx, ecx
cmovne esi, eax
je 0x408507
mov edx, 0x209
lea ecx, [esp + 0x4c0]
lea ecx, [ecx + edi*2]
sub edx, edi
je 0x4084ee
mov esi, 0x7ffffffe
sub ebx, ecx
test esi, esi
je 0x4084ee
movzx eax, word [ebx + ecx]
test ax, ax
je 0x4084ee
mov word [ecx], ax
dec esi
add ecx, 2
sub edx, 1
jne 0x4084d5
test edx, edx
lea eax, [ecx - 2]
mov esi, 0x8007007a
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
xor eax, eax
test edx, edx
cmovne esi, eax
test esi, esi
jne 0x4089b2
mov ebx, dword [esp + 0x24]
lea eax, [esp + 0x68]
push dword [ebx + 0x658]
push dword [ebx + 0x1174]
push str._X:_X
push 0x20
push eax
call fcn.00401090
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x4089ab
movups xmm0, xmmword [str._remoteservers:remoteinvoke:]
mov ax, word [0x414958]
push 0x7c6
movups xmmword [esp + 0x8dc], xmm0
mov word [esp + 0x914], ax
lea eax, [esp + 0x916]
movups xmm0, xmmword [0x414930]
push esi
push eax
movups xmmword [esp + 0x8f4], xmm0
movups xmm0, xmmword [0x414940]
movups xmmword [esp + 0x904], xmm0
movq xmm0, qword [0x414950]
movq qword [esp + 0x914], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x14], esi
lea eax, [esp + 0x14]
push eax
lea eax, [ebx + 0x1fb04]
push eax
call dword [sym.imp.rpcrt4.dll_UuidToStringW]
test eax, eax
jne 0x40899f
mov ecx, 0x400
lea eax, [esp + 0x8d8]
nop dword [eax]
cmp word [eax], 0
je 0x4085de
add eax, 2
sub ecx, 1
jne 0x4085d0
mov eax, 0x400
mov edi, ecx
sub eax, ecx
mov esi, 0x80070057
neg edi
sbb edi, edi
and edi, eax
xor eax, eax
test ecx, ecx
cmovne esi, eax
je 0x408652
mov edx, 0x400
lea ecx, [esp + 0x8d8]
lea ecx, [ecx + edi*2]
sub edx, edi
je 0x408639
mov edi, dword [esp + 0x14]
mov eax, 0x7ffffffe
sub edi, ecx
nop dword [eax]
test eax, eax
je 0x408639
movzx esi, word [edi + ecx]
test si, si
je 0x408639
mov word [ecx], si
dec eax
add ecx, 2
sub edx, 1
jne 0x408620
test edx, edx
lea eax, [ecx - 2]
mov esi, 0x8007007a
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
xor eax, eax
test edx, edx
cmovne esi, eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.rpcrt4.dll_RpcStringFreeW]
test esi, esi
jne 0x408998
mov eax, dword [ebx + 0x1fafc]
and eax, 0xffffffde
push eax
mov eax, dword [esp + 0x20]
movzx eax, word [eax + 4]
push eax
push dword [ebx + 0x1fb14]
lea eax, [ebx + 0x1fb18]
push dword [ebx + 0x69c]
push eax
push str._s_X_d_d_d
lea eax, [esp + 0x10f0]
push 0x208
push eax
call fcn.00401090
mov esi, eax
add esp, 0x20
test esi, esi
jne 0x408998
mov ecx, 0x400
lea eax, [esp + 0x8d8]
nop dword [eax + eax]
cmp word [eax], 0
je 0x4086ce
add eax, 2
sub ecx, 1
jne 0x4086c0
mov eax, 0x400
mov edi, ecx
sub eax, ecx
mov esi, 0x80070057
neg edi
sbb edi, edi
and edi, eax
xor eax, eax
test ecx, ecx
cmovne esi, eax
je 0x408742
mov edx, 0x400
lea ecx, [esp + 0x8d8]
lea ecx, [ecx + edi*2]
sub edx, edi
je 0x408729
lea edi, [esp + 0x10d8]
mov esi, 0x7ffffffe
sub edi, ecx
nop dword [eax]
test esi, esi
je 0x408729
movzx eax, word [edi + ecx]
test ax, ax
je 0x408729
mov word [ecx], ax
dec esi
add ecx, 2
sub edx, 1
jne 0x408710
test edx, edx
lea eax, [ecx - 2]
mov esi, 0x8007007a
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
xor eax, eax
test edx, edx
cmovne esi, eax
test esi, esi
jne 0x408998
lea eax, [esp + 0x10]
mov dword [esp + 0x5c], str._SMSSQLSERVER
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
lea eax, [esp + 0x4c0]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x68]
mov dword [esp + 0x60], eax
lea eax, [esp + 0x8d8]
push eax
mov dword [esp + 0x68], eax
lea eax, [esp + 0x6c]
push eax
push str._SMSSQLSERVER
lea eax, [esp + 0x4cc]
push eax
lea eax, [esp + 0x20]
push eax
push eax
push dword [esp + 0x30]
push str.Remote_dump_on__s_invoked_with_parameters__s__s__s__s__s__s
push 2
push 0x41b030
call fcn.00401ad0
mov edi, dword [sym.imp.ADVAPI32.dll_StartServiceW]
lea eax, [esp + 0x78]
add esp, 0x28
push eax
push 6
push ebp
call edi
mov ebx, dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x408858
mov esi, dword [sym.imp.kernel32.dll_Sleep]
call ebx
cmp eax, 0x420
jne 0x4087ee
push 0x64
call esi
lea eax, [esp + 0x50]
push eax
push 6
push ebp
call edi
test eax, eax
je 0x4087d1
jmp 0x408858
call ebx
call ebx
push 0
push 0x400
mov esi, eax
lea eax, [esp + 0x14f0]
push eax
push 0x400
push esi
push 0
push 0x1000
call dword [sym.imp.kernel32.dll_FormatMessageW]
test eax, eax
je 0x40883e
lea eax, [esp + 0x14e8]
push eax
push esi
push str.Unable_to_start_service
push str._s_0x_x____ls
push 1
push 0x41b030
call fcn.00401ad0
add esp, 0x18
jmp 0x408858
push esi
push str.Unable_to_start_service
push str._s_0x_x
push 1
push 0x41b030
call fcn.00401ad0
add esp, 0x14
xorps xmm0, xmm0
mov dword [esp + 0x4c], 0
movups xmmword [esp + 0x2c], xmm0
xor esi, esi
movups xmmword [esp + 0x3c], xmm0
nop
lea eax, [esp + 0x28]
mov dword [esp + 0x28], esi
push eax
push 0x24
lea eax, [esp + 0x34]
push eax
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4088c1
mov ecx, dword [esp + 0x30]
mov eax, ecx
sub eax, 2
je 0x4088a6
sub eax, 2
je 0x4088a6
sub eax, 0xc
jne 0x408942
xorps xmm0, xmm0
mov dword [esp + 0x4c], esi
push 0x64
movups xmmword [esp + 0x30], xmm0
movups xmmword [esp + 0x40], xmm0
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x408870
call ebx
mov esi, eax
test esi, esi
jle 0x4088d2
movzx esi, si
or esi, 0x80070000
call ebx
push 0
push 0x400
mov edi, eax
lea eax, [esp + 0x14f0]
push eax
push 0x400
push edi
push 0
push 0x1000
call dword [sym.imp.kernel32.dll_FormatMessageW]
test eax, eax
je 0x408920
lea eax, [esp + 0x14e8]
push eax
push edi
push str.Unable_to_query_service_state
push str._s_0x_x____ls
push 1
push 0x41b030
call fcn.00401ad0
add esp, 0x18
jmp 0x40893a
push edi
push str.Unable_to_query_service_state
push str._s_0x_x
push 1
push 0x41b030
call fcn.00401ad0
add esp, 0x14
test esi, esi
jne 0x40896b
mov ecx, dword [esp + 0x30]
push dword [esp + 0x40]
push dword [esp + 0x4c]
push dword [esp + 0x40]
push ecx
push dword [esp + 0x4c]
push dword [esp + 0x2c]
push str.Remote_dump_on__s_completed_with_status__X__state__X__exitCode__X__process__d__step__d_
push 2
push 0x41b030
call fcn.00401ad0
add esp, 0x24
test ebp, ebp
jne 0x4089c3
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
jmp 0x408310
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x408991
movzx esi, si
or esi, 0x80070000
push str.Unable_to_locate_specific_SQLDUMPER_service
jmp 0x4089be
push str.Unable_to_construct_launch_parameter
jmp 0x4089be
mov esi, 0x80004005
push str.Unable_to_serialize_guid
jmp 0x4089be
push str.Unable_to_prepare_dumper_flags
jmp 0x4089be
push str.Instance_name_too_long
jmp 0x4089be
push str.Service_name_too_long
call fcn.00407f10
push dword [esp + 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
test ebp, ebp
je 0x4089f3
push ebp
call edi
jmp 0x4089f3
call ebx
mov esi, eax
test esi, esi
jle 0x4089e9
movzx esi, si
or esi, 0x80070000
push str.Unable_to_open_SCM_on_remote_box
call fcn.00407f10
test esi, esi
je 0x408a01
or dword [0x41b020], 0x20008000
mov ecx, dword [esp + 0x1cec]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040e29f
add esp, 0x1ce0
ret 4